The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run npx -y react-doctor@latest . --verbose. This executes a shell command that runs a third-party utility with full access to the project's source code and file system.
[EXTERNAL_DOWNLOADS]: The use of npx at runtime fetches the react-doctor package from the public NPM registry. The use of the @latest tag ensures the most recent version is used but bypasses version pinning, which can be a risk if the package is compromised.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted codebase data.
Ingestion points: The tool scans the entire codebase (current directory .) as specified in SKILL.md.
Boundary markers: None are used to separate codebase content from the agent's instructions.
Capability inventory: The skill possesses command execution capabilities via npx in SKILL.md.
Sanitization: There is no evidence of sanitization or filtering of the codebase content before it is processed by the diagnostic tool.

react-doctor