The Agent Skills Directory

[SAFE]: The skill is designed for repository auditing and does not exhibit any malicious behaviors such as data exfiltration, obfuscation, or credential harvesting.
[COMMAND_EXECUTION]: The skill includes a Python script, scripts/score_repo.py, which performs read-only analysis of a local directory. The script utilizes standard libraries for file system traversal and regex-based content analysis.
[DATA_EXPOSURE]: The script reads project files (like README.md and package.json) to verify the presence of setup and validation tools. It includes path resolution logic using pathlib.Path.resolve() and relative_to() to ensure that file access remains constrained within the targeted repository root.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text from project documentation files to calculate scores. While the script itself does not execute code from these files, the extracted text could potentially contain adversarial instructions aimed at influencing the AI agent's final report. This is a low-risk surface inherent to document-parsing tools.

agentic-legibility