The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx -y to execute the react-doctor package from the npm registry. The -y flag suppresses the installation prompt, and the use of @latest ensures the command always runs the most recent version of the package without allowing for version pinning or auditing of the code being executed.
[EXTERNAL_DOWNLOADS]: Fetches the react-doctor package from the official npm registry at runtime whenever the command is invoked.
[COMMAND_EXECUTION]: Instructs the agent to execute shell commands using npx to perform diagnostics on the codebase.
[INDIRECT_PROMPT_INJECTION]: The skill ingests all files in the current directory for analysis, which represents a potential attack surface for indirect prompt injection if the codebase contains malicious instructions intended to influence the agent or the analysis tool.
Ingestion points: The skill passes the current directory . as an argument to the react-doctor command in SKILL.md for full codebase scanning.
Boundary markers: No delimiters, markers, or explicit instructions are provided to the agent to treat the codebase content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has the capability to execute shell commands via npx as defined in SKILL.md.
Sanitization: There is no evidence of content sanitization, validation, or filtering of the files before they are processed by the tool.

react-doctor