The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the graphifyy package via PyPI. There is a naming discrepancy between this package name (graphifyy) and the linked GitHub repository (graphify), which is a common characteristic of a typosquatting or supply chain attack.
[REMOTE_CODE_EXECUTION]: The workflow requires installing and executing the graphifyy tool and running Node.js and Python extraction scripts (extract_ts.ts, extract_py.py) within the local environment. These tools have full access to the project directory and file system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's codebase—including docstrings, comments, and project structure—to generate documentation and Pull Request descriptions. This creates an attack surface where malicious content within a codebase could influence the agent's output.
Ingestion points: Source code files (.py, .ts, .tsx, .js, .jsx) and project configuration files scanned during the extraction process in SKILL.md and referenced scripts.
Boundary markers: The instructions do not implement explicit delimiters or "ignore embedded instructions" warnings when interpolating extracted code content into generated documentation or PR bodies.
Capability inventory: The agent can write files (README.md, docs/API.md), execute shell commands for dependency installation (pip install), and perform network operations via the GitHub CLI (gh pr create).
Sanitization: The instructions do not specify any programmatic validation, escaping, or sanitization of the extracted content before it is used in documentation templates.

docs-from-code