The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes standard system utilities including ls, grep, and npm outdated to discover the project's structure, identify dev tools, and check dependency status.
[DYNAMIC_EXECUTION]: The skill uses a Node.js one-liner (node -e) to programmatically extract the scripts keys from the local package.json file. This is used for analysis of the local development loop and does not involve untrusted remote code.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from various project files such as README.md, Makefile, and CONTRIBUTING.md. These files represent a surface for indirect prompt injection where malicious content in the files could influence the agent's DX score.
Ingestion points: Project manifests, documentation files, and build scripts discovered in the project root (SKILL.md).
Boundary markers: None present.
Capability inventory: Shell command execution (ls, grep, npm, node) and file system reads.
Sanitization: Content from these files is evaluated for scoring purposes without explicit sanitization.

devex-review