The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes common shell utilities such as ls, find, grep, and date to analyze the repository state and generate audit reports. It also facilitates the execution of project-specific runners like npm run arch or Makefile targets to validate architectural rules.
[EXTERNAL_DOWNLOADS]: The skill identifies missing architectural dependencies and offers to install them using standard ecosystem managers (e.g., npm, pip, poetry, dotnet, go, cargo). Security is maintained through a mandatory user confirmation step before any external installation or configuration changes occur.
[DYNAMIC_EXECUTION]: The skill detects and executes local "fitness function" scripts (e.g., scripts/arch/verify.mjs, scripts/arch/verify.py) or specialized tools like dependency-cruiser and ArchUnit. It incorporates safety checks by prompting the user for approval when execution commands are ambiguous or runtime environments are missing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests architectural rules and criteria from Markdown files within the repository (docs/standards/*.md, AGENTS.md). While these files are technically untrusted input, the skill mitigates risk by using structural parsing (YAML frontmatter and specific table IDs) and explicitly instructing the agent to ignore non-actionable prose context.
Ingestion points: Reads architecture standards (docs/standards/*.md), agent rules (AGENTS.md), and decision records (docs/adr/*.md).
Boundary markers: Relies on specific Markdown headers (##), requirement IDs (CR-XXX), and YAML metadata to delimit instructions.
Capability inventory: Includes shell command execution, script execution (node, python, npx), and package installation via system package managers.
Sanitization: Instructions specify the extraction of atomic, verifiable rules only and provide a strict template for reporting results.

arch-audit