The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to perform codebase analysis.
Evidence: Execution of shell commands including find, wc, grep, cat, ls, and cloc to analyze file structure and content.
[EXTERNAL_DOWNLOADS]: The skill uses npx to execute external developer utilities from the npm registry.
Evidence: npx webpack-bundle-analyzer and npx depcheck are used to analyze project dependencies.
[DATA_EXFILTRATION]: The skill is designed to search for and expose potentially sensitive information as part of its security audit function.
Evidence: It uses grep to scan for patterns like password, secret, api_key, token, and Bearer tokens in the source code.
Evidence: It reads the .gitignore file to ensure environment files like .env are not tracked by version control.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests and processes data from potentially untrusted codebases.
Ingestion points: The skill uses Read, Grep, and Glob tools to scan project files (SKILL.md).
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when processing file content.
Capability inventory: The agent has access to Bash, allowing for full system interaction based on findings.
Sanitization: No sanitization or filtering of the audited codebase content is specified.

project-health-auditor