The Agent Skills Directory

[COMMAND_EXECUTION]: The skill recommends executing numerous diagnostic shell commands, including npx tsc --version, node -v, and monorepo detection scripts. A specific complex command uses node -e to evaluate logic that parses package.json for tooling detection.
[DYNAMIC_EXECUTION]: The script scripts/ts_diagnostic.py utilizes subprocess.run with shell=True. While the current usage is limited to hardcoded strings, this implementation choice is a best-practice violation that could facilitate command injection if extended with user-controlled data.
[INDIRECT_PROMPT_INJECTION]: The skill processes project files (package.json, tsconfig.json, and source code) which serve as ingestion points for untrusted data. Ingestion points: reads from package.json and src/ directories. Boundary markers: none identified in the instructions or scripts. Capability inventory: broad command execution capabilities including npm, npx, and Python subprocesses. Sanitization: the skill lacks sanitization of external file content before using it to drive diagnostic logic.

typescript-expert