The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx skills add to download and install a secondary skill from the raintree-technology/hig-doctor GitHub repository. This effectively executes installation logic from an external third-party source.
[EXTERNAL_DOWNLOADS]: The skill executes npx -y hig-doctor@<version>, which fetches and runs an arbitrary package from the NPM registry at runtime to perform the HIG audit.
[COMMAND_EXECUTION]: The skill relies on shell commands and piped logic (e.g., grep, bash tests) within its installation instructions to determine environment state and trigger package additions.
[INDIRECT_PROMPT_INJECTION]: The skill audits interface source code (Swift, React, etc.) which is an untrusted ingestion point.
Ingestion points: Reads local source code files in various frameworks.
Boundary markers: None identified in the provided instructions to prevent the agent from obeying instructions embedded in code comments during the audit process.
Capability inventory: The skill has the capability to report findings and help remediate them, which may involve file-write operations based on the tool's output.
Sanitization: No specific sanitization or filtering of the audited code content is described.

hig-doctor