The Agent Skills Directory

[SAFE]: The skill contains a 'Security Rules' section in SKILL.md that explicitly forbids high-risk behaviors including eval, curl | bash piping, silent dependency installations, and file operations outside the project directory.
[COMMAND_EXECUTION]: The scripts/audit-coupling.sh utility is used for static analysis of the codebase. The script is written defensively, employing set -euo pipefail, validating the existence and readability of input directories, and checking for path traversal attempts (..). It uses find and grep with safe argument handling (xargs -0) to scan source files.
[DATA_EXPOSURE]: While the skill analyzes source code and database references, it includes specific instructions to never include secrets, API keys, or credentials in its output or reports.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of local project source code to identify service boundaries. The risk is mitigated by explicit instructions to prioritize evidence-based analysis over 'guesses' and the requirement for user confirmation before any extraction or modification occurs.

monolith-boundary-finder