The Agent Skills Directory

[SAFE]: No security issues detected. The skill consists of instructional markdown files and local Python scripts used for extracting and linting Russian UI strings. All identified operations are confined to the local project environment and align with the skill's stated purpose of UI copy localization and review.
[INDIRECT_PROMPT_INJECTION]: The skill includes an attack surface for indirect prompt injection because it is designed to ingest and process untrusted data from a user's codebase (e.g., source code, localization files). However, this behavior is central to the skill's intended functionality and does not involve unsafe interpolation or high-privilege operations.
Ingestion points: scripts/extract_ui_strings.py reads project source files (.json, .yml, .ts, etc.) to extract text.
Boundary markers: None explicitly implemented in the extraction logic.
Capability inventory: The skill is instructed to perform code edits, update localization files, and execute project-standard commands (e.g., linting) identified from the project's lockfiles.
Sanitization: Standard text extraction and regex-based cleaning are performed, but no deep sanitization of the processed data is present.

sasha