The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes heavy use of npx to run utilities like knip, jscpd, and remove-unused-vars. Specifically, it identifies remove-unused-vars as a 'highly experimental' tool (version 0.0.x), which introduces a minor supply chain risk as it is executed directly from the npm registry without a pinned version in the command string.
[COMMAND_EXECUTION]: The skill instructions automate the execution of shell commands, including piping output from a linter directly into a code-modifying tool (npx eslint ... -f json | npx remove-unused-vars). While efficient, this automated modification of the filesystem relies on the integrity of the linter output.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from tool outputs and potentially acting upon it.
Ingestion points: Reads JSON output from knip --reporter json (into knip-files.json) and eslint -f json via pipes.
Boundary markers: The skill partially mitigates this by requiring an 'approved plan-dead-code.md' (human-in-the-loop) and explicitly warning not to 'delete from a raw tool dump'. However, no machine-level delimiters or sanitization are used in the shell pipes themselves.
Capability inventory: The skill uses knip --fix-type and remove-unused-vars which have capabilities to delete files and modify source code.
Sanitization: There is no mention of escaping or validating the JSON output from tools before it is processed by subsequent scripts or the agent.

housekeep-dead-code