The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md and STYLE.md recommend that the agent use shell commands such as node -e for code verification and cat for inspecting files like package.json and tsconfig.json.
[DYNAMIC_EXECUTION]: The skill encourages the agent to evaluate JavaScript snippets at runtime using node -e to ensure accuracy when explaining language behaviors like type coercion and evaluation order.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user-provided code and has the capability to execute shell commands. There are no specific instructions for sanitizing user-provided snippets before the agent executes them for verification.
Ingestion points: User-provided JavaScript files, code snippets, and repository configuration files as described in the mentor's codebase analysis instructions.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the verification instructions.
Capability inventory: Shell execution through node -e and file reading through cat.
Sanitization: The instructions do not mandate any sanitization or safety checks for external content before it is processed for mentoring purposes.

javascript-mentor