The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains a shell script scripts/audit-mongoose-schemas.sh that utilizes find, grep, and xargs to audit local directories. It implements basic path validation to prevent traversal outside the project directory.
[DATA_EXFILTRATION]: The audit script reads local file contents from the target directory to generate a report. While the data remains local, this represents an automated reading capability that exposes project source code to the agent's context.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the scanning of untrusted source code.
Ingestion points: The scripts/audit-mongoose-schemas.sh script reads and extracts content from all JS/TS files in the user-provided project directory.
Boundary markers: Extracted snippets are wrapped in markdown code blocks in the generated report, but there are no explicit instructions for the agent to disregard instructions found within the scanned code.
Capability inventory: The skill allows for file modifications and package installations (via npm install), which could be exploited if the agent obeys instructions found in the scanned code.
Sanitization: The script performs raw line extraction using grep without sanitization or filtering of the content.

mongoose-to-prisma-drizzle-migrator