The Agent Skills Directory

[SAFE]: The skill implements a read-only approach to repository analysis, utilizing Python's Abstract Syntax Tree (AST) for static inspection of source code and regular expressions for pattern matching.
[SAFE]: External configuration files are handled securely; the script uses yaml.safe_load() to prevent potential code execution vulnerabilities during the parsing of context files.
[SAFE]: File system interactions are limited to reading from the user-specified repository path and writing structured analysis results to a local directory. The script explicitly excludes sensitive or irrelevant directories such as .git and __pycache__ to minimize exposure.
[SAFE]: No network-enabled tools, remote code execution patterns, or hardcoded credentials were identified in the source code or configuration files.
[SAFE]: Indirect prompt injection analysis: The skill processes untrusted files from external repositories but performs only static analysis without code execution. Ingestion points: scripts/analyze_project.py reads files via repo.rglob('*'). Boundary markers: Absent in the generated markdown summaries. Capability inventory: Local file writes to the output directory and stdout printing. Sanitization: Uses json.dumps for structured data outputs.

analyze-project