The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script dynamically loads a Node.js module from a path constructed from user-supplied input.
Evidence: In map.ts, the function loadTypescript(repoRoot) attempts to load the typescript package from the target project using createRequire(join(repoRoot, 'package.json'))('typescript').
Risk: An attacker could distribute a repository containing a malicious module at node_modules/typescript. If a user analyzes this repository using the skill, the malicious code would be executed during the mapping process.
[PROMPT_INJECTION]: The skill processes untrusted source code and presents it to an LLM, creating a potential surface for indirect prompt injection.
Ingestion points: The skill recursively reads the content of all source files in the target repository using walk() and readFileSync() in map.ts.
Boundary markers: The resulting output uses simple file and directory headers but lacks robust delimiters or explicit instructions for the agent to ignore commands that might be embedded in the code symbols.
Capability inventory: The skill has the ability to traverse the filesystem and write the output map to a file (project-structure-map.txt).
Sanitization: While the script squashes whitespace and caps the length of signatures to fit context windows, it does not sanitize or escape content to prevent an LLM from interpreting instructions hidden within the source code.
[COMMAND_EXECUTION]: The documentation provides instructions to execute shell commands using node or package runners.
Evidence: SKILL.md instructs the user to run the mapper using node <this-skill-dir>/map.ts or npx tsx.
Context: These are standard operating procedures for the skill's primary utility and involve execution of the skill's own provided scripts.

project-structure