The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local Python scripts to perform static analysis. Execution is limited to the skill's logic, and it does not invoke external shell commands or process user input as executable code.
[EXTERNAL_DOWNLOADS]: The skill operates offline with no network connectivity, ensuring no external code or data is fetched during execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided source code which acts as an ingestion point for untrusted data. While malicious instructions could be embedded in code comments and then reflected in analysis reports, the tool lacks high-privilege capabilities like network access for exfiltration. 1. Ingestion points: Component source files (.jsx, .vue) read by scripts/analyze_components.py. 2. Boundary markers: None are implemented to isolate extracted code content from the agent's context. 3. Capability inventory: Local file reading and writing; no network or arbitrary command execution. 4. Sanitization: None.

component-analyzer