The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script (references/metrics.py) using uv run. This script subsequently executes the git ls-files command to identify tracked files in the target repository. This is a legitimate and standard operation for a code analysis tool.
[PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection because its core function involves reading and analyzing untrusted content from a target codebase (e.g., CLAUDE.md, .bon/understanding.md, and source files).
Ingestion points: Project documentation and source files are read into the agent's context during the measurement and examination stages.
Boundary markers: While the skill uses markdown headers to organize data, it lacks specific instructions or delimiters designed to isolate potentially adversarial content within the analyzed files.
Capability inventory: The orchestrating agent and sub-agents have access to standard analysis tools including Bash, Agent, Read, Glob, and Grep.
Sanitization: No sanitization or filtering of the analyzed file content is performed before it is processed by the sub-agents.

toise