The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local shell script (detect-framework.sh) to identify the project's web framework (Express, Next.js, Fastify, etc.) by analyzing the package.json file. This is a functional requirement for selecting the correct tracing patterns.
[INDIRECT_PROMPT_INJECTION]: As a code analysis tool, the skill ingests untrusted application code provided by the user. While this creates an attack surface for indirect prompt injection, the skill includes explicit 'Essential Principles' and 'Boundaries' that instruct the agent to perform read-only analysis, summarize external dependencies, and explain rather than execute the code. Detailed formatting guidelines for explanations further mitigate risk by providing structure.
[SAFE]: No hardcoded credentials, malicious obfuscation, or unauthorized persistence mechanisms were found. External documentation links point to reputable package registries like npmjs.com. The use of memory tools (write_memory, read_memory) is correctly scoped to session persistence for the user's tracing activity.

code-trace