The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes and executes local Python scripts (complexity_analyzer.py, dependency_graph.py) to perform static analysis on the user's project files. This is a documented and intended feature of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external source code for analysis, which represents an indirect prompt injection surface. Maliciously crafted code comments or string literals could theoretically attempt to influence the agent's logic during the analysis phase.
Ingestion points: scripts/complexity_analyzer.py and scripts/dependency_graph.py (via Path.glob for .kt files).
Boundary markers: Absent; file content is read and processed directly.
Capability inventory: The analysis scripts perform read-only operations on the local file system to extract metadata.
Sanitization: No specific sanitization or escaping is performed on the ingested code content.

matematico-tao