The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to execute remote code at runtime via package runners for tools like jscpd and truffler.
Evidence: Commands such as npx jscpd and bunx @rayhanadev/truffler in DUPLICATION.md execute packages directly from remote registries without strict version pinning or verification of the source.
[EXTERNAL_DOWNLOADS]: The skill requires downloading and installing external software from third-party repositories.
Evidence: DUPLICATION.md includes instructions to run brew install nimblesite/tap/deslop and fetches the @rayhanadev/truffler Node.js package.
[COMMAND_EXECUTION]: The skill defines specific shell commands that the agent is expected to run during the refactoring and auditing process.
Evidence: The DUPLICATION.md file provides exact CLI commands for running jscpd, truffler, and deslop search operations.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it is designed to ingest and analyze untrusted source code while possessing significant shell capabilities.
Ingestion points: The agent reads and processes the user's local source code files (as described in SKILL.md and DUPLICATION.md).
Capability inventory: The skill utilizes subprocess calls to package managers (npx, bunx, brew) and auditing tools that parse code structure.
Boundary markers: None identified; the instructions do not include specific delimiters or directives to ignore instructions that might be embedded within comments or strings in the code being refactored.
Sanitization: No evidence of sanitization or validation of the code content or the output from third-party tools is mentioned.

refactoring