The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various shell commands for environment inspection (git status), repository management (git checkout, git commit), and execution of specialized analysis tools (staticcheck, deadcode, madge, knip).
[EXTERNAL_DOWNLOADS]: The skill downloads and installs external packages and binaries from official language registries using npx, gem install, and go install. It utilizes well-known tools including knip, madge, and ts-prune via NPM; debride via RubyGems; and Go analysis tools from official domains (honnef.co and golang.org).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code from the local codebase to generate cleanup recommendations, creating a surface for indirect prompt injection where malicious patterns in the code could influence agent behavior.
Ingestion points: The skill reads files throughout the target codebase in SKILL.md (Step 2: Research Phase) and passes them to subagents.
Boundary markers: Subagent prompts in SKILL.md use section headers and structured output formats to define task scope, though these do not fully eliminate injection risks.
Capability inventory: The skill possesses extensive capabilities including file modification, git branch management, and shell command execution for tool installation and analysis across all files.
Sanitization: There is no evidence of sanitization or filtering of codebase content before it is interpolated into prompts for the AI subagents.

deslop