The Agent Skills Directory

Indirect Prompt Injection (SAFE): The skill is designed to analyze user-provided source code (TypeScript/JavaScript). While this ingestion of untrusted data constitutes a surface for indirect prompt injection, the risk is inherent to the tool's intended use case as a code-quality assistant. The skill's internal logic is benign and follows a structured workflow approach to provide feedback.
Ingestion points: User-provided code files during review and refactoring workflows.
Boundary markers: The workflow utilizes a structured report-based architecture that provides a clear context for analysis.
Capability inventory: The agent is guided to execute local development commands such as npm test and git as part of the documented workflows.
Sanitization: No explicit sanitization of input data is defined, which is standard for static documentation-based skills.
Remote Code Execution (SAFE): Documentation examples include standard development commands like npm test and git commit. These are well-defined local operations within the context of a software development environment. No evidence of unauthorized remote script execution or dynamic loading from untrusted sources was found.
Data Exposure (SAFE): No hardcoded credentials, sensitive file paths (e.g., SSH keys, AWS credentials), or exfiltration attempts were detected. The skill focuses solely on providing architectural and stylistic guidance for software development.

typescript-clean-code