The Agent Skills Directory

[SAFE]: The skill operates entirely locally on a user-provided repository path and produces structured JSON output. It does not attempt to access sensitive system directories, environment variables, or hardcoded credentials.
[EXTERNAL_DOWNLOADS]: The skill requires the tree-sitter-language-pack Python package, which is a well-known library for high-level language parsing. This dependency is standard for the skill's stated purpose of polyglot static analysis.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted source code and identifiers from external repositories. However, this risk is mitigated by its parse-only nature.
Ingestion points: File content is read from the local filesystem in scripts/find_untested_sources.py using path.read_text().
Boundary markers: The tool outputs results in a structured JSON format, which provides clear delimitation between data and instructions for the consuming agent.
Capability inventory: Across all scripts, the skill is limited to directory walking and file reading; no subprocess spawning, dynamic code execution (eval/exec), or network operations were found.
Sanitization: Content is processed via formal grammar parsing with tree-sitter, and file reading uses errors='replace' to handle malformed encoding safely.

find-untested-sources-polyglot