The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to perform dependency installations (e.g., npm install, pip install) within temporary git worktrees to support analysis. It also executes tools via npx (e.g., npx knip). These actions involve downloading and executing code from external registries based on the project's configuration files, which could lead to the execution of malicious scripts if the analyzed project contains compromised manifest files.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of third-party tools and packages from external registries (NPM, PyPI, etc.) through the use of package managers and npx commands during the analysis phase.
[COMMAND_EXECUTION]: The skill extensively uses shell-based CLI tools and system commands for its core functionality, including git worktree, git show, grep, and language-specific tools like vulture, periphery, and deadcode.
[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted codebases, creating a surface for indirect prompt injection.
Ingestion points: The skill reads all source files (**/*.ts, **/*.py, etc.) and project configuration files (package.json, Cargo.toml, etc.) as defined in SKILL.md.
Boundary markers: The instructions do not define explicit delimiters or warning markers for the data being processed, although they specify that the codebase should be treated as read-only.
Capability inventory: The skill has access to the shell (CLI tools, git), the filesystem (creation/deletion of worktrees in $TMPDIR), and the ability to dispatch subagents.
Sanitization: No sanitization or filtering of the ingested code content is mentioned before it is processed by the agent or subagents.
[DYNAMIC_EXECUTION]: The skill uses a parallel subagent strategy, dispatching up to 8 Agent tool calls to perform directory-specific scans. This coordinates multiple autonomous execution flows based on the structure of the target codebase.

find-dead-code