The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local codebase, including code comments (e.g., TODO, FIXME) and function bodies, which are ingested into the agent context via grep and static analysis tools. Maliciously crafted comments could potentially influence the agent's behavior.
Ingestion points: Output from grep and pnpx fallow commands as described in SKILL.md and references/detection-patterns.md.
Boundary markers: The skill does not define clear delimiters or instructions to ignore embedded commands in the code it analyzes.
Capability inventory: Includes the ability to execute shell commands (grep, find, git, pnpm) and read file contents.
Sanitization: No sanitization or filtering is applied to the content extracted from the files before processing.
[COMMAND_EXECUTION]: The skill provides numerous shell command snippets for the agent to run locally to identify debt patterns.
Evidence: references/detection-patterns.md contains commands for finding duplicates, unused exports, and large files using grep, find, and awk.
[EXTERNAL_DOWNLOADS]: The skill utilizes the fallow package, which is fetched from the official npm registry at runtime via pnpx.
Evidence: SKILL.md recommends using pnpx fallow for deeper static analysis.

techdebt-finder