The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local bash scripts (scripts/phase1_discovery.sh and scripts/phase2_analysis.sh) to perform directory traversal, file searches, and git log inspections.
[COMMAND_EXECUTION]: The analysis scripts utilize python3 -c to execute inline code for parsing and processing project metadata from package.json files.
[DATA_EXFILTRATION]: The skill's discovery logic specifically targets sensitive configuration files for inspection, including .env files, Docker configurations, and Git history.
[CREDENTIALS_UNSAFE]: The phase2_analysis.sh script employs grep commands with regex patterns to locate and extract hardcoded secrets, such as passwords and API keys, directly from the project's source code.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted code, comments, and README content from analyzed projects and incorporates this data into its context and generated reports.
Ingestion points: Codebase content processed via find, grep, and cat in the discovery and analysis phases.
Boundary markers: No delimiters or safety instructions are present to prevent the agent from obeying instructions embedded within the analyzed project files.
Capability inventory: Subprocess execution (bash), directory manipulation, and file writing.
Sanitization: The skill lacks validation or escaping mechanisms for the external code content it processes before generating reports.

project-analyzer