The Agent Skills Directory

Command Execution: The skill provides instructions for the agent to execute a Python script (generate_rank_input.py) to generate discovery artifacts. This is a standard requirement for the skill's function but involves running commands with parameters derived from the repository environment.
Indirect Prompt Injection Surface: The skill's primary function is to ingest and analyze untrusted code from external repositories. While this exposes the agent to potentially malicious content designed to influence its behavior, the skill mitigates this by providing a rigorous discovery checklist and anchoring rules.
Dynamic Script Invocation: The skill relies on scripts located in a computed plugin directory path. This pattern allows the skill to utilize specialized tools for security analysis but depends on the integrity of the local environment where the plugin is installed.

finding-discovery