The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install or run the gitnexus package from the npm registry using npm install -g gitnexus or npx gitnexus@latest. The source code for this tool is hosted at github.com/abhigyanpatwari/GitNexus, which is a third-party repository not associated with trusted organizations.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code downloaded from a remote registry (npm). By providing instructions to install and run the gitnexus binary, it enables the execution of externally sourced logic on the local system.
[COMMAND_EXECUTION]: The skill utilizes several shell commands to interact with the repository and the tool's backend, including gitnexus analyze, gitnexus serve, gitnexus status, and gitnexus clean. These commands involve indexing files, starting a local HTTP server, and deleting local tool caches.
[DYNAMIC_EXECUTION]: The skill uses gitnexus analyze --skills to dynamically generate new agent instructions (SKILL.md files) within the .claude/skills/generated/ directory at runtime. This creates a supply-chain risk where the generated skills might execute unintended logic based on the repository content being analyzed.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface by ingesting and indexing untrusted codebase content.
Ingestion points: gitnexus analyze reads all source files in the current repository to build a knowledge graph.
Boundary markers: The skill suggests using --skip-agents-md to avoid overwriting existing agent files, but there are no explicit boundaries defined for the data processed by the graph engine.
Capability inventory: The skill can execute shell commands, start network servers, and write new skill files to the disk.
Sanitization: There is no evidence of sanitization or filtering of the codebase content before it is used to generate documentation or agent skills.
[DATA_EXPOSURE]: The skill accesses the local file ~/.gitnexus/registry.json to inspect the list of indexed repositories, revealing metadata about the user's project structure to the tool.

gitnexus-repo-map