The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow is centered on the execution of multiple Node.js scripts (detect-topic.js, fetch-docs.js, analyze-llms-txt.js) provided within the skill package. These scripts run with the agent's local permissions to perform network requests and file system operations.
[DATA_EXFILTRATION]: The scripts/utils/env-loader.js utility is designed to recursively search for and load .env files from parent directories, including .claude/.env. This allows the skill's local scripts to access sensitive environment variables and credentials stored globally in the agent's configuration environment, which are then available in the process memory during network operations to external domains.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation data from https://context7.com using the Node.js https module. Additionally, the repo-analysis.md workflow instructs the agent to use git clone to download entire repositories from arbitrary external URLs for local analysis.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from external sources (such as llms.txt files and cloned repositories) without implementing explicit boundary markers or sanitization before the agent analyzes the results.
Ingestion points: Content is fetched via scripts/fetch-docs.js and git clone as described in workflows/repo-analysis.md.
Boundary markers: The instructions do not specify the use of XML tags or specific delimiters to isolate untrusted external content from the agent's primary instructions.
Capability inventory: The skill uses node for script execution, git for repository cloning, and cat for file reading.
Sanitization: There is no evidence of content filtering or safety-stripping before the fetched documentation is presented to the agent for analysis.

docs-seeker