The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/extract-extension-config.sh script executes the ext_emconf.php file from the target project's root directory using the PHP include directive within a php -r command to extract metadata.
[REMOTE_CODE_EXECUTION]: The scripts/check-ui-surface-screenshots.sh script executes the Configuration/Backend/Modules.php file from the target project using the PHP @include directive to count registered modules.
[DYNAMIC_EXECUTION]: The skill's core functionality relies on executing PHP code from the environment it is auditing to extract configuration and architectural details, which is a high-risk pattern when applied to untrusted or third-party codebases.
[COMMAND_EXECUTION]: The skill uses docker run to pull and execute the ghcr.io/typo3-documentation/render-guides:latest container image. This command mounts the current project directory as a volume, potentially exposing project data to the container environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect prompt injection:
Ingestion points: The skill reads content from various project files, including PHP source code (Classes/), configuration files (Configuration/), ext_emconf.php, composer.json, and project metadata (README.md, CHANGELOG.md).
Boundary markers: No explicit boundary markers or safety instructions are used when interpolating this external content into the Documentation/ANALYSIS.md report or JSON data files.
Capability inventory: The skill has the ability to write to the file system, execute shell commands, and run Docker containers based on the analysis results.
Sanitization: There is no evidence of sanitization or escaping of the extracted content before it is processed or presented to the agent.
[EXTERNAL_DOWNLOADS]: The scripts/render_docs.sh script pulls the ghcr.io/typo3-documentation/render-guides:latest image from the GitHub Container Registry.
[EXTERNAL_DOWNLOADS]: The scripts/extract-repo-metadata.sh script makes network requests to GitHub and GitLab APIs using the gh and glab CLI tools to fetch repository information.

typo3-docs