The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the @codometer/cli package, which is executed via npx. This involves downloading and running code from an external registry.
[COMMAND_EXECUTION]: The skill provides instructions for executing the codometer command-line tool within a directory to perform measurements and checks.
[INDIRECT_PROMPT_INJECTION]: The skill describes processes where the agent reads reports (JSON/Markdown) generated by analyzing local source code. This creates a surface for indirect prompt injection, as malicious instructions could be embedded in the code being analyzed (e.g., in function names or comments) and subsequently reflected in the reports read by the agent.
Ingestion points: Reading JSON reports and Markdown badge blocks produced by codometer (SKILL.md).
Boundary markers: The skill does not define specific delimiters or instructions to ignore content within the reports.
Capability inventory: The skill facilitates command-line execution of analysis tools.
Sanitization: No sanitization or validation of the report content is mentioned before the agent processes it.

codometer-measure