The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data that could influence its behavior.
Ingestion points: scripts/analyze.py and its associated extractors (python_extractor.py, typescript_extractor.py) read names, function signatures, and docstrings from the local repository and store them in dag-registry.json.
Boundary markers: scripts/compose.py interpolates the registry content into a prompt for the LLM without using delimiters or instructions to ignore embedded commands within the extracted docstrings.
Capability inventory: scripts/compile.py generates executable Python or TypeScript code based on the output of the composition phase.
Sanitization: There is no sanitization or filtering of the docstring content extracted from the analyzed repository before it is sent to the LLM.
[COMMAND_EXECUTION]: The compile command in scripts/compile.py generates standalone executable Python and TypeScript scripts based on the dag-plan.json artifact. While the skill employs an AST-based validator for predicate expressions to restrict dangerous operations, the core functionality is designed to generate code for later execution.
[EXTERNAL_DOWNLOADS]: scripts/compose.py makes outbound HTTP POST requests using the httpx library to external LLM providers (defaulting to OpenRouter) to perform the DAG composition. This behavior is documented and configurable via environment variables like DAG_LLM_BASE_URL.

dag-typesafe