The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx @claude-flow/cli@latest to download and execute an external package from the public NPM registry. This package is not from a recognized trusted organization or well-known service.
[REMOTE_CODE_EXECUTION]: The use of npx @claude-flow/cli@latest fetches and runs code from a remote repository at runtime, which allows for unverified code execution.
[COMMAND_EXECUTION]: The skill performs multiple shell operations using the Bash tool, including find, grep, sed, and npx, to discover project structure and report findings.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled source code files, creating a surface for indirect prompt injection if those files contain instructions designed to influence the agent's behavior.
Ingestion points: TypeScript files within the src/*/domain/ directory (SKILL.md).
Boundary markers: Absent. The instructions do not define delimiters or provide guidance to the agent to ignore instructions embedded in the scanned code.
Capability inventory: The skill has access to shell execution via the Bash tool and external package execution via npx (SKILL.md).
Sanitization: Absent. The skill uses grep to extract content from files and processes it directly without validation or escaping.

ddd-validate