The Agent Skills Directory

Command Execution: The skill executes several shell commands to facilitate the assessment process.
Evidence: Commands such as dotnet tool update, appcat analyze, and npm install are used to install tools and perform analysis.
Context: These operations are standard for a development-focused skill that needs to interact with local build systems and assessment utilities.
External Downloads: The skill installs external utilities required for its assessment tasks from established package registries.
Evidence: It installs dotnet-appcat via the .NET CLI and npm-check-updates via npm.
Context: Fetching tools from official registries like NuGet and npm is a routine part of maintaining a project's assessment environment.
Indirect Prompt Injection Surface: The skill processes external data from the project's repository, which represents a potential surface for indirect instructions.
Ingestion points: The skill reads project-specific configuration files such as .csproj for .NET and package.json for JavaScript projects.
Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" warnings when processing the content of these files.
Capability inventory: The skill has the ability to execute shell commands (dotnet, npm, mkdir, ncu, appcat) and write files to the local file system.
Sanitization: There is no explicit mention of sanitizing or validating the content extracted from project files before it is used in command arguments or internal logic.

assessment