The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection syntax to discover project manifest files when the skill is loaded.
Evidence: !find . -maxdepth 1 $ -name "package.json" ... $ -type f in SKILL.md.
The command is a benign discovery operation restricted to searching for specific manifest filenames in the root directory.
[COMMAND_EXECUTION]: The skill executes various system commands and internal scripts to facilitate dependency audits.
Evidence: It executes bash "${CLAUDE_SKILL_DIR}/scripts/code-dep-audit.sh" and system tools like npm audit, pip-audit, and cargo audit.
These commands are required for the skill's intended functionality and are explicitly listed in the allowed-tools configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local project manifests and output from external audit tools, creating a potential surface for indirect injection.
Ingestion points: Local manifest files (e.g., package.json, Cargo.toml) and the JSON output from auditing utilities processed in scripts/code-dep-audit.sh.
Boundary markers: Absent. The skill does not implement specific delimiters to isolate tool-generated content from the agent's core instruction set.
Capability inventory: The agent can execute shell commands, perform package updates (via the --fix parameter), and modify files using TodoWrite.
Sanitization: Absent. No explicit validation or escaping of package metadata or vulnerability descriptions is performed before the information is presented to the agent.
Note: The risk is low because the helper script primarily summarizes data into structured counts (e.g., VULN_CRITICAL), though the final report still interpolates package names into the summary.

code-dep-audit