The Agent Skills Directory

[SAFE]: The skill's primary purpose is repo auditing and technical debt discovery. It performs analysis on local files and git history without attempting to exfiltrate data or perform unauthorized actions. It explicitly forbids the agent from editing code or executing fixes.
[EXTERNAL_DOWNLOADS]: The skill recommends the use of several well-known third-party analysis tools such as Vulture (Python), Knip (JS/TS), and Lizard (complexity analysis). These are reputable tools obtained from established registries like PyPI and NPM, or via standard package managers. Per internal guidelines, references to well-known technology services for their intended purpose are considered safe.
[COMMAND_EXECUTION]: The skill uses a restricted set of shell commands (git log, git blame, grep, find, wc) to analyze the repository. These commands are scoped to the local environment and are standard for repository metadata extraction.
[PROMPT_INJECTION]: As the skill ingests and processes arbitrary source code and git logs, it is technically susceptible to indirect prompt injection (where instructions hidden in code could influence the agent). However, as the skill is diagnostic-only and does not possess capabilities for autonomous execution or code modification, the risk is significantly mitigated.
[SAFE]: There is a configuration mismatch between the allowed-tools YAML field and the tools recommended in the markdown (e.g., lizard, vulture). While this may limit the skill's functionality if the execution platform strictly enforces the tool list, it represents a best-practice violation rather than a security vulnerability.

fight-repo-rot