The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing local Python scripts (scripts/project_scaffolder.py and scripts/code_quality_analyzer.py) to perform its primary functions. These scripts have the capability to read and write to the file system. As the source code for these scripts is not provided, their exact behavior and safety cannot be verified.
[PROMPT_INJECTION]: The Code Quality Analyzer tool processes untrusted external data (project files). This creates an indirect prompt injection surface.
- Ingestion points: Arbitrary project files read by scripts/code_quality_analyzer.py (SKILL.md).
- Boundary markers: None identified in the instructions to prevent the agent from obeying instructions embedded in analyzed code.
- Capability inventory: File-system write/read and subprocess execution via the provided scripts (SKILL.md).
- Sanitization: No evidence of input validation or sanitization before processing codebase content.
[EXTERNAL_DOWNLOADS]: The scaffolding workflow involves generating configurations for npm and pip, leading to the installation of numerous third-party dependencies from external registries. While typical for development, this expands the attack surface via the software supply chain.

senior-fullstack