The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands such as find and grep to analyze the repository structure and locate compliance evidence.
[COMMAND_EXECUTION]: The skill executes local architecture-related scripts (e.g., node scripts/arch/verify.mjs, python scripts/arch/verify.py) and developer tools (e.g., npx depcruise, mvn test, pytest) to run fitness functions.
[EXTERNAL_DOWNLOADS]: In Fase 3.5, the skill may download and install packages via standard managers (e.g., npm, pip, maven, cargo) if authorized by the user to fulfill dependency requirements found in audited standards.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from repository files (docs/standards/*.md, docs/adr/*.md, AGENTS.md) to determine audit rules, which is an inherent ingestion surface for instructions that could influence the agent's audit findings.
Ingestion points: Reads markdown files from docs/standards/, docs/adr/, and the root AGENTS.md.
Boundary markers: Relies on structured YAML frontmatter and markdown tables, but lacks explicit sanitization instructions for the natural language descriptions processed within these files.
Capability inventory: Extensive shell execution capabilities including file system inspection and package installation.
Sanitization: No specific sanitization or escaping of the ingested file content is documented before processing or inclusion in report generation.

arch-audit