The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator and subagents execute various command-line interface (CLI) tools such as git, knip, madge, vulture, and staticcheck for code analysis. It also runs project-specific test and type-checking commands (e.g., npm test, pytest) detected from configuration files. These operations are standard for development tooling and are managed by safety gates that halt execution if tests fail.
[DATA_EXPOSURE]: The skill performs extensive read and write operations on the local filesystem to analyze and refactor source code. No evidence of unauthorized data exfiltration or transmission of sensitive information to external servers was detected.
[REMOTE_CODE_EXECUTION]: The skill relies on locally installed tools or standard package runners (e.g., npx) to execute its subagents and analysis tools. It does not download or execute arbitrary scripts from untrusted remote sources.
[INDIRECT_PROMPT_INJECTION]: As the skill processes the entire codebase, including comments and third-party code, it is theoretically exposed to indirect prompt injection. However, the subagent logic (particularly the Slop Comment Cleaner) is specifically designed to identify and remove AI-generated meta-narration and noise, which serves as a mitigation against such vectors.

slop-cleanup