The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the bumblebee scanner from Perplexity AI's official GitHub repository using go install. Perplexity AI is recognized as a well-known service, and the download is consistent with the skill's primary purpose.\n- [COMMAND_EXECUTION]: Executes the bumblebee CLI to perform inventory scans and the go binary to manage the installation. These commands are gated by user-provided parameters like scan profiles and root paths.\n- [COMMAND_EXECUTION]: Executes a local Python helper script (scripts/render_report.py) to convert scan records into a Markdown report. The script uses only standard libraries and includes basic path validation to prevent traversal.\n- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it ingests metadata from local packages, extensions, and configurations that could contain malicious instructions designed to influence the agent when it reads the final summary.\n
Ingestion points: Local filesystem package metadata read by the bumblebee tool and the resulting NDJSON records processed by scripts/render_report.py.\n
Boundary markers: Absent. The skill summarizes scan findings directly in the chat reply without explicit delimiters or instructions to ignore embedded content.\n
Capability inventory: Shell command execution (go, bumblebee, python3), file read/write access within the user's workspace.\n
Sanitization: scripts/render_report.py performs standard JSON parsing but does not sanitize or escape string content before interpolating it into the Markdown report or the summary text.

bumblebee