The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes automation scripts for codebase analysis. The shell script scripts/analyze-codebase.sh and Python script scripts/count-dependencies.py execute system commands such as find, awk, git, and grep to calculate lines of code, file counts, and dependency distributions. These tools are used for the legitimate purpose of informing the complexity scoring rubric described in the skill instructions.
[DYNAMIC_CONTEXT_INJECTION]: The file scripts/assess-complexity.md leverages dynamic context placeholders (using the !command syntax) to provide the agent with project statistics at load time. Commands like !pwd, !git rev-parse, and !find are executed to automatically populate the agent's context with the project root, file counts, and recent activity levels during task assessment. These commands are static and do not incorporate unvalidated user input.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection through its codebase analysis functionality. While the risk is minimal due to the quantitative nature of the analysis, it meets the criteria for this category:
Ingestion points: Local project files are read and processed by scripts/analyze-codebase.sh and scripts/count-dependencies.py to generate metrics.
Boundary markers: No explicit markers or 'ignore' instructions are used within the shell scripts when scanning file contents for metrics.
Capability inventory: The skill has the ability to execute subprocesses (via shell and python scripts) and perform file system reads across the project directory.
Sanitization: The metrics gathering process uses standard unix tools which count lines and occurrences without executing or interpreting the content of the files being scanned as instructions.

quality-gates