The Agent Skills Directory

[SAFE]: The skill documents and facilitates the use of Knip, a reputable and widely-used open-source tool for dead code detection in TypeScript/JavaScript projects. The provided shell and PowerShell scripts are standard wrappers for health checks and do not contain malicious logic.
[EXTERNAL_DOWNLOADS]: The skill uses npx to execute Knip, which is a standard method for running Node.js CLI tools. It also references official GitHub Actions (actions/checkout, actions/setup-node) which are provided by a well-known service provider and are considered safe under the trust scope rules.
[COMMAND_EXECUTION]: The skill includes scripts and instructions to run npx knip. While the --fix and --allow-remove-files flags can modify the filesystem by deleting unused exports and files, the skill provides specific agent guidance to ensure these actions are performed safely, categorizing them into 'Auto-delete' for low-risk items and 'Ask before acting' for potential entry points or public APIs.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface as it processes local project source code and configuration files. However, the risk is mitigated by explicit operational instructions for the agent:
Ingestion points: Local filesystem analysis via knip execution.
Boundary markers: The skill defines clear logical boundaries between safe-to-delete items and those requiring human confirmation.
Capability inventory: File system modification (deletion) and CLI tool execution.
Sanitization: The skill instructs the agent to batch clarifying questions and avoid taking high-risk actions without user consent.

tl-knip