The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/scan.sh script accepts a user-controlled path (SCAN_PATH) which is interpolated directly into several shell commands, including find, grep, wc, and various tool invocations (e.g., pylint, radon, npx). The lack of validation or escaping on this variable allows for arbitrary command execution if a malicious path containing shell metacharacters is passed to the script.
[EXTERNAL_DOWNLOADS]: The script utilizes npx --yes to run tools like jscpd, ts-prune, and madge. This command automatically fetches the packages from the npm registry if they are not present on the system, leading to external downloads at runtime.
[REMOTE_CODE_EXECUTION]: The execution of code fetched via npx --yes represents a remote code execution vector, although the packages targeted are well-known development tools.
[PROMPT_INJECTION]: The skill performs technical debt analysis by reading file contents and asking the agent to 'interpret and report' the findings. This creates a surface for indirect prompt injection, where an attacker could place instructions inside TODO comments or code files to manipulate the agent's output or recommendations.
Ingestion points: scripts/scan.sh (reads files via grep, wc, and analysis tools)
Boundary markers: Absent
Capability inventory: Shell command execution via scripts/scan.sh, network access via npx
Sanitization: No sanitization of scanned file content or the SCAN_PATH argument
[DATA_EXFILTRATION]: The script attempts to access a local configuration file at ~/.claude/docs/development/registry.yaml. Accessing sensitive application configuration paths without explicit user intent can lead to unintended data exposure.

techdebt