The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code as its primary input, creating a surface for indirect prompt injection via code comments or string literals.
Ingestion points: The agent identifies and reads source files in the 'Identify scope' and 'Measure' workflow steps.
Boundary markers: The skill does not explicitly define mandatory boundary markers in the final report output to isolate potentially adversarial content found in source files.
Capability inventory: The skill utilizes scripts/metrics.py for file analysis and generates a markdown report (docs/maintainability-review.md).
Sanitization: The skill includes mandatory redaction instructions for credentials and secrets (<redacted>), which mitigates data exposure risks, though it lacks specific sanitization for instruction-like text in code comments.
[COMMAND_EXECUTION]: The skill executes local Python scripts (scripts/metrics.py and a configuration resolver) to gather metrics. This is a standard functional requirement for this type of analysis tool and utilizes the skill's own distributed scripts.
[SAFE]: The skill implements security best practices by instructing the agent to never reproduce discovered secrets in reports and providing a specific protocol for redacting sensitive data. All external documentation links target the author's official blog, which is consistent with the skill's provenance.

review-maintainability