The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script scripts/dep_doctor.py to analyze dependency manifests. The script uses only the Python standard library and does not invoke external shell commands, subprocesses, or dynamic execution engines like eval().- [DATA_EXFILTRATION]: The skill provides an optional check for yanked releases on PyPI. This involves fetching package metadata from pypi.org, which is a well-known service for the Python ecosystem. This operation is user-triggered, targets a known service, and does not transmit sensitive information from the user's environment.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of user-provided manifest files. However, it handles this safely by: (1) Ingestion: Reading specific file paths provided by the user via load_manifest. (2) Boundaries: Prompt instructions require the agent to explain findings in plain language and wait for explicit user approval before suggesting or applying changes. (3) Capabilities: The processing script performs static analysis only and does not execute the contents of the manifests. (4) Sanitization: The tool uses standard libraries like tomllib and json for structured parsing and specific regular expressions for text-based requirements.- [SAFE]: No obfuscation, hardcoded credentials, persistence mechanisms, or privilege escalation attempts were detected. The skill's behavior is consistent with its stated purpose as a local development utility.

dependency-doctor