The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides commands to download components of the NLPM toolset from its official project repository.\n
Sources: The scripts nlpm-check and nlpm-badge are hosted on the project's official GitHub repository at github.com/xiaolai/nlpm.\n
Context: These are provided as 'upstream' alternatives to the local auditing script included with the skill.\n- [REMOTE_CODE_EXECUTION]: Documentation guides the user on how to execute the project's auditing scripts using a Python interpreter.\n
Evidence: The skill instructions include commands like python3 ./nlpm-check . for performing repository-wide audits.\n
Security: The documentation explicitly recommends pinning downloads to specific, reviewed commits to maintain security and reproducibility.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external natural-language artifacts which represents a potential attack surface for indirect prompt injection.\n
Ingestion points: The scripts/nl_artifact_check.py script and the audit workflow read content from SKILL.md, AGENTS.md, CLAUDE.md, and other markdown or JSON manifest files.\n
Boundary markers: The auditing process treats file content as static text for pattern matching and quality scoring rather than as instructions to be executed by the model.\n
Capability inventory: The agent has the capability to read files and execute shell commands to run the provided auditing scripts.\n
Sanitization: The scripts/nl_artifact_check.py script uses regular expressions to identify structural defects and does not interpolate file content into executable contexts.

nlpm-audit