The Agent Skills Directory

COMMAND_EXECUTION (SAFE): The skill utilizes grep and glob to perform static analysis of the local codebase. This is a core function of the tool and is used appropriately to find dead code and placeholders.
EXTERNAL_DOWNLOADS (LOW): In resources/pruning-guide.md, the skill recommends running npx depcheck. While this involves downloading and executing a remote package from the npm registry, it is a standard practice in development environments. The severity is lowered from MEDIUM to LOW due to its alignment with the skill's primary purpose.
PROMPT_INJECTION (LOW): The skill possesses a surface for indirect prompt injection because it ingests untrusted source code during the audit process. A malicious file could contain instructions designed to deceive the agent's reporting.
Ingestion points: Codebase files are read and searched using grep and glob (referenced in SKILL.md and resources/pruning-guide.md).
Boundary markers: Absent; the skill does not explicitly use delimiters to isolate ingested code from its instructions.
Capability inventory: File system access (Read, Grep, Glob) and reporting capabilities.
Sanitization: The skill does not describe any sanitization of the content being audited before it is processed for the final report.

code-review