The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch the @claude-flow/cli package from the npm registry. This occurs at runtime and retrieves the latest version of the package.
[REMOTE_CODE_EXECUTION]: The execution of @claude-flow/cli via npx runs external code within the local environment. Because the package uses the @latest tag rather than a pinned version, it is susceptible to supply chain attacks or breaking changes in the remote repository.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes local files to detect coverage gaps, which creates an attack surface for instructions embedded in data.
Ingestion points: Local source code and directories provided via the --path argument (found in SKILL.md).
Boundary markers: None. The instructions do not define delimiters or specific warnings to ignore instructions found within the analyzed files.
Capability inventory: The skill has access to Bash and the mcp__plugin_ruflo-core_ruflo__hooks_worker-dispatch tool.
Sanitization: No sanitization or validation of the analyzed file content is mentioned.

test-gaps