The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to run detection commands such as node -e "console.log(require.resolve('es-toolkit/package.json'))" and yarn node. These are standard methods for resolving package locations within a Node.js environment and do not involve untrusted input.
[INDIRECT_PROMPT_INJECTION]: The skill identifies the project environment by reading local files including package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock, and package.json.
Ingestion points: Reads project configuration and lockfiles (SKILL.md).
Boundary markers: None explicitly defined for the ingested file content.
Capability inventory: The skill has access to Bash, Read, Grep, and Glob tools.
Sanitization: No specific sanitization or validation of the lockfile content is described, though the usage is limited to identifying the package manager and resolving package exports.

guide