The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze-code.ts uses execSync to run the TypeScript compiler (npx tsc) on extracted code snippets to validate their syntax and types.
[DYNAMIC_EXECUTION]: The analyzer generates temporary TypeScript files at runtime from content extracted from markdown documentation and then attempts to compile them to verify correctness.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it ingests untrusted data from multiple files across the project and processes it using a compiler and shell commands.
- Ingestion points: The discoverSkills function in scripts/analyze-code.ts reads the content of all SKILL.md files found within the project root.
- Boundary markers: No delimiters or instructions are used to signal the agent to ignore potentially malicious instructions embedded within the code blocks of the files being scanned.
- Capability inventory: The skill possesses the capability to execute shell commands (execSync) and perform file system writes (writeFileSync) for generating reports and temporary build artifacts.
- Sanitization: There is no sanitization or escaping of the code extracted from the documentation before it is written to temporary files for compilation.

umbraco-skill-code-analyzer