The Agent Skills Directory

[COMMAND_EXECUTION]: The skill incorporates the execution of local Python scripts (api_linter.py, breaking_change_detector.py, and api_scorecard.py) to perform its primary functions. Instructions and examples in SKILL.md demonstrate the use of these scripts within CI/CD pipelines and pre-commit hooks to analyze API specification files.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data in the form of API specifications (OpenAPI/Swagger, GraphQL SDL, and gRPC proto). This represents an indirect prompt injection surface where malicious instructions could be embedded within the processed data.
Ingestion points: API specification files provided by users or fetched from repositories are processed by scripts referenced in SKILL.md (e.g., scripts/api_linter.py openapi.json).
Boundary markers: The provided instructions do not define explicit boundary markers or delimiters to separate the API content from the agent's instructions during processing.
Capability inventory: The skill has the capability to execute shell commands via Python scripts, read local files, and generate structured reports based on its analysis.
Sanitization: There is no evidence of input sanitization or filtering to prevent the agent from following instructions embedded within the API documentation or metadata fields of the processed specifications.

api-design-reviewer