The Agent Skills Directory

[SAFE]: The skill reads project configuration files such as package.json, composer.json, and pyproject.toml to extract technical stack information for documentation. This is standard behavior for project analysis tools.
[COMMAND_EXECUTION]: Executes git log and git remote to gather historical context and repository information. These commands are used solely for information gathering and do not modify the repository state.
[SAFE]: Accesses .env.example files to document environment variables. This is a safe practice as it avoids accessing production .env files containing actual secrets.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input by reading the project's codebase and existing documentation to generate new summaries. This presents a theoretical surface for indirect prompt injection, but it is the primary function of the documentation generator and includes no mechanisms for external exfiltration.

docs