The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands to facilitate its primary function. It executes git to retrieve code changes, gitleaks for secret detection, ast-grep (sg) for pattern matching, and scc for code statistics.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx to execute the madge utility for circular dependency analysis. This is a standard workflow in JavaScript/TypeScript development environments for running packages from the npm registry.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data (code changes) from external branches, which creates a potential surface for indirect prompt injection if those changes contain malicious instructions.
Ingestion points: Reads code diffs and logs via git diff and git log commands in SKILL.md.
Boundary markers: Absent. The agent processes the raw output of the git commands directly.
Capability inventory: The skill has access to Bash (allowing execution of various analysis tools) and can write to a local file (progress.txt).
Sanitization: Absent. No filtering or escaping is applied to the code changes before they are presented to the agent for review.

review