The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled script scripts/audit.mjs executes several external commands using node:child_process.spawnSync, including git (to determine repository names), gh (to fetch repository metadata and community profiles), and curl (to fetch social preview images). These are used to validate that project documentation aligns with the actual state of the repository.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to GitHub's API via the gh CLI and uses curl to download social preview images from URLs provided by the GitHub API. These operations are restricted to well-known GitHub services and are used for documentation verification.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests untrusted data from README.md and AGENTS.md files during the audit process.
Ingestion points: Files are read from the repository root in scripts/audit.mjs (README.md, AGENTS.md, package.json, etc.) and repository metadata is fetched via the GitHub API.
Boundary markers: The instructions do not explicitly include boundary markers or "ignore embedded instructions" warnings when processing these files, though the process is structured as an audit with specific rule-based matches.
Capability inventory: The skill has the capability to write to the file system (rewriting README/AGENTS.md), execute subprocesses (git, gh, curl), and call other AI agent skills.
Sanitization: Content is analyzed using regex-based rules to detect specific patterns, but the skill relies on the agent to interpret findings and perform rewrites.

re0-readme