The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation routine in references/tool-installer.md downloads and executes a setup script from the nvm-sh GitHub repository using a shell pipe (curl | bash).
[EXTERNAL_DOWNLOADS]: The skill fetches configuration scripts and installs global CLI packages, including bower, grunt-cli, gulp-cli, and yarn, to establish the necessary environment for auditing legacy toolchains.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to manage Node.js versions (nvm install), install project dependencies (npm install, bower install), and execute test suites using runners like Karma, Grunt, or Gulp.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code and configuration files from external repositories, which presents a surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: Reads project source files (app/, src/, scripts/), templates (.html), and manifest files (package.json, bower.json) via multiple analysis agents.
Boundary markers: The instructions do not define specific delimiters or security headers to prevent the model from obeying instructions embedded in the analyzed code.
Capability inventory: The skill possesses significant capabilities including arbitrary shell command execution (Bash), file creation (Write), and subagent orchestration (Agent/Task).
Sanitization: There is no evidence of sanitization or escaping of project-provided content before it is processed by the AI agents or included in the final markdown report.

angularjs-health-audit