The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes standard system commands such as find, grep, ls, and cat to discover project structure and read configuration files like package.json and Makefile. It also uses python3 -c for safe parsing of JSON and configuration data.
[EXTERNAL_DOWNLOADS]: The skill sends analyzed project metadata to the Google Gemini API (generativelanguage.googleapis.com) to generate documentation content. This is a trusted endpoint and the operation is central to the skill's documented purpose.
[INDIRECT_PROMPT_INJECTION]: The skill reads untrusted data from local project files (e.g., script names in package.json) and interpolates them into a prompt for the Gemini API.
Ingestion points: Reads package.json, tsconfig.json, Makefile, Cargo.toml, go.mod, and .env.example (SKILL.md Steps 4-5).
Boundary markers: Uses a structured system instruction for the LLM to enforce formatting and brevity (SKILL.md Step 6).
Capability inventory: Performs file discovery, local file reads, network POST requests to Gemini, and local file writes.
Sanitization: There is no explicit sanitization of the scanned text, but the skill implements a mandatory human-in-the-loop review (Step 8) where the user must approve the generated draft before it is written to disk.
[CREDENTIALS_UNSAFE]: The skill requires a GEMINI_API_KEY for its operation. It follows standard security practices by instructing the user to provide this key via a .env file rather than hardcoding it.

claude-md-generator