The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute several shell commands to configure the environment, audit code, and filter results based on source control status.
Evidence: The process includes fallow --version, fallow audit --format json --quiet, and git diff --staged --name-only.
[EXTERNAL_DOWNLOADS]: The skill initiates the download and global installation of an external software package from the NPM registry that is not associated with a verified or trusted vendor.
Evidence: The instructions specify running npm install -g fallow if the utility is not already present.
[PROMPT_INJECTION]: An indirect prompt injection surface exists because the skill ingests untrusted data from project files and analysis reports to drive automated logic and code modifications.
Ingestion points: Source code files across multiple languages and the JSON output from the fallow tool.
Boundary markers: There are no explicit instructions or delimiters provided to prevent the agent from obeying instructions that might be hidden within the code it is reviewing.
Capability inventory: The skill utilizes shell command execution and file modification capabilities.
Sanitization: No validation or sanitization of the analyzed content is performed before processing.

find-mismatch