The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands (grep, wc, cat) and an embedded Python script to analyze project configuration files such as package.json, go.mod, and requirements.txt.
[EXTERNAL_DOWNLOADS]: The skill attempts to use the cost-of-modules utility via npx. It uses the --no-install flag to restrict execution to already-installed packages, mitigating the risk of silent remote package downloads.
[COMMAND_EXECUTION]: The logic includes an embedded Python script used to parse package.json. This script is static and performs safe operations using the Python standard library (json, sys) to count dependencies.
[PROMPT_INJECTION]: Indirect Prompt Injection Risk Assessment:
Ingestion points: Reads project configuration files (package.json, go.mod, requirements.txt, Cargo.toml) and scans project source code for performance patterns.
Boundary markers: None. Content from project files is processed directly by shell utilities and the agent.
Capability inventory: Subprocess execution for file analysis; potential for file system writes when the --fix flag is requested by the user.
Sanitization: No specific sanitization or escaping of file content is performed before processing.

performance-profiler