The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses read-only shell commands, such as git log, git ls-files, and git remote, to gather repository metadata and history for documentation purposes. It also utilizes language-specific tools like go list to identify project structures.
[PROMPT_INJECTION]: The skill processes project files (source code and configuration files like package.json, pyproject.toml, or Cargo.toml) to generate the README content. This introduces a surface for indirect prompt injection where malicious content within a scanned repository could attempt to influence the agent's output.
Ingestion points: The agent reads local project configuration files and source code directories.
Boundary markers: No explicit delimiters or warnings are used when processing file content.
Capability inventory: The skill is limited to reading files and generating text; it does not possess network-write or arbitrary command execution capabilities that could be abused via injection.
Sanitization: The skill does not explicitly perform sanitization of the ingested code or metadata before including descriptions in the generated README.
[EXTERNAL_DOWNLOADS]: The skill constructs URLs for project badges using well-known and trusted services, including GitHub, Shields.io, Codecov, and language-specific package registries (pkg.go.dev, crates.io). These references are used for standard documentation features.

init-readme