The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via scripts/dep_scan.sh and Phase 0 baseline probes to determine build and test status as well as dependency currency. These commands are limited to standard development tools (such as npm, pytest, cargo, and mvn) and project-defined scripts. The skill follows a strict read-only contract, ensuring these executions do not mutate tracked files.
[EXTERNAL_DOWNLOADS]: The dependency scanning process involves network requests to official package registries and vulnerability databases (e.g., via npm audit or pip-audit) to fetch the latest version information and security advisories. These operations target well-known, trusted services.
[DATA_EXPOSURE]: The skill specifically audits for secrets and security vulnerabilities (the SEC dimension). It identifies hardcoded credentials and sensitive file paths within the codebase and reports them with specific citations to enable developer remediation.
[INDIRECT_PROMPT_INJECTION]: Because the skill audits external codebases, it ingests untrusted data (source code and manifests). This creates an indirect prompt injection surface. However, the skill's architecture mitigates this by requiring findings to be backed by specific evidence citations and strictly following predefined reporting and planning templates.

codebase-modernizer