The Agent Skills Directory

[SAFE]: The skill is designed for static analysis of local project files to identify technical debt such as large files, complex functions, and outdated dependencies. All scripts use standard Python and Node.js libraries and do not perform network operations or access sensitive system files.
[DYNAMIC_EXECUTION]: The script scripts/detect_code_smells.py uses __import__('datetime') within an f-string to add a timestamp to the generated report. This is a benign use of dynamic loading for a standard library module with a hardcoded name and does not pose a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code, which constitutes an attack surface for indirect prompt injection. Given the context of static analysis, this is considered a low-risk surface.
Ingestion points: JavaScript and TypeScript source files read by scripts/detect_code_smells.py and package.json read by scripts/analyze_dependencies.py.
Boundary markers: Absent; the content is read directly without delimiters or warnings against embedded instructions.
Capability inventory: File system read access in Python scripts; suggested shell command execution (grep, find, npm, npx) in SKILL.md.
Sanitization: The scripts use regular expressions for pattern matching, which provides a layer of validation but does not specifically sanitize against adversarial prompt injection attacks.

tech-debt-analyzer