The Agent Skills Directory

[SAFE]: The skill serves as a mentor and explicitly reinforces security best practices, including warnings against hardcoding secrets, logging sensitive environment variables, and using insecure path concatenation methods that could lead to directory traversal. It also emphasizes the risk of blocking the event loop, which helps prevent Denial of Service (DoS) conditions in Node.js applications.
[COMMAND_EXECUTION]: The instructions direct the agent to run benign environment-discovery commands (such as node -v and node -p) to determine the runtime version and module type of the project being analyzed. These commands are used for calibration and are not associated with malicious privilege escalation or arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection because it is designed to analyze project files like package.json and JavaScript source code. While a maliciously crafted codebase could theoretically influence the agent's behavior, the skill's specific instructions for structured analysis and its use of read-only probing tools minimize this risk.
Ingestion points: Project configuration files (package.json) and source code provided by the user for analysis.
Boundary markers: The agent is instructed to read file contents directly to calibrate its technical responses, with no explicit delimiters to segregate data from instructions.
Capability inventory: Execution of standard node CLI commands for environment discovery.
Sanitization: The agent relies on the built-in parsing of Node.js for reading configurations and does not perform additional sanitization of file contents before analysis.

node-mentor