The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/dep_health.py uses subprocess.run to call the GitHub CLI tool (gh). The input repository slug is validated against a strict regular expression (^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$) which prevents command injection by disallowing spaces and shell metacharacters.
[EXTERNAL_DOWNLOADS]: The skill fetches package metadata from well-known, trusted services including pypi.org, registry.npmjs.org, and the GitHub API. These network operations are standard for the skill's purpose and target official registries.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external APIs which could contain untrusted content.
Ingestion points: Data is fetched via urllib and gh api in scripts/dep_health.py.
Boundary markers: None explicitly used in the output rendered for the agent.
Capability inventory: The script performs network reads and local command execution (via gh).
Sanitization: The script mitigates potential injection by truncating external strings (e.g., package summaries are limited to 200 characters) and using regex to validate repository identifiers. This significantly reduces the attack surface.

dependency-diligence