The Agent Skills Directory

[COMMAND_EXECUTION]: The Core Workflow in SKILL.md explicitly instructs the agent to perform validation using shell commands, including python -m doctest, pytest --doctest-modules, tsc --noEmit, and npx @redocly/cli lint. This demonstrates the skill's intent to execute arbitrary terminal commands on the user's environment.
[REMOTE_CODE_EXECUTION]: Step 5 of the core workflow (Validate) involves running doctest or pytest on code files. These utilities are designed to execute code examples embedded within documentation strings. If an attacker provides a codebase with malicious payloads hidden in docstring examples (e.g., inside triple-backticks or >>> prompts), the agent will execute that code during the validation phase.
[EXTERNAL_DOWNLOADS]: The skill and its reference files (e.g., references/coverage-reports.md, references/documentation-systems.md) reference and suggest the installation of numerous third-party tools and packages from NPM and PyPI, such as @redocly/cli, eslint-plugin-jsdoc, pydocstyle, and interrogate. While these are standard developer tools, the workflow involves their download and execution.
[DATA_EXPOSURE]: The skill's primary function involves deep analysis of source code, configuration files, and API specifications. While this is the intended purpose, it establishes a workflow where sensitive intellectual property or internal system configurations are ingested and processed by the agent.

code-documenter