The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and analyze data from untrusted external codebases.
Ingestion points: The skill reads various manifest files (package.json, requirements.txt, etc.) and source code files from the user's project directory.
Capability inventory: The skill has access to Bash and file system tools (Read, Glob, Grep) and can execute local analysis scripts.
Boundary markers: No explicit delimiters or warnings to ignore instructions embedded in the analyzed code were identified in the instructions.
Sanitization: There is no evidence of content sanitization before the agent processes the file data for its analysis report.
[COMMAND_EXECUTION]: The skill utilizes shell commands to facilitate project analysis and interact with development environments.
Execution of core logic: The main entry point (main.cjs) spawns a Node.js process to run the analyzer.mjs script located in the skill's tool directory.
External tool invocation: The skill's instructions suggest running standard ecosystem tools such as npm audit, npm outdated, or local linters (ESLint, Ruff) to assess project health.
Argument passing: Command-line arguments are passed from the agent to the underlying analyzer script using an array-based spawn method.

project-analyzer