The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several local Bash and Python scripts (e.g., inventory-project.sh, token-usage.py, build-component-pages.py) to perform static analysis of the project's source code. These scripts identify library stacks, design system dominance, and component import chains. The execution is limited to local file system operations without network activity.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project source code to generate structured audit data, creating a potential attack surface.
Ingestion points: The scripts scan files within the src/ and app/ directories using regex to extract metadata.
Boundary markers: The skill explicitly instructs the agent to read and cite specific fields from the generated JSON artifacts rather than processing raw code directly.
Capability inventory: The skill uses Bash, Read, Glob, Grep, and Write for file discovery and report generation.
Sanitization: The extraction logic focuses on structural properties (e.g., PascalCase export names, token variable patterns) rather than free-text content, which naturally mitigates the risk of instructions leaking from the source code into the agent's context.

sb-inventory