The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various CLI tools including npx, uv, awk, and sed. Specifically, it uses npx to list available skills and uv run python to parse YAML configuration files locally. These commands are focused on auditing and reporting tasks.
[EXTERNAL_DOWNLOADS]: Uses npx to interact with the skills package to list items from the author's own repository (ValorVie/ai-dev-skills). These operations target well-known package registries and vendor-owned resources.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by ingesting the content of SKILL.md files from the local filesystem into the agent's context for semantic analysis.
Ingestion points: Files located in ~/.config/everything-claude-code/skills/ are read using awk and sed.
Boundary markers: Not explicitly defined in the prompts for the agent context.
Capability inventory: The skill can execute shell commands, read configuration files, and write markdown reports to upstream/reports/.
Sanitization: The skill uses string processing tools (awk, sed) to extract specific metadata (like descriptions) rather than reading full files, which limits the potential injection surface.
[SAFE]: The skill follows security best practices by using yaml.safe_load for parsing configuration and implements guardrails that prevent automatic modification of system settings, requiring manual user intervention for any proposed changes.

custom-skills-ecc-analyze