The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries and bundled scripts for analysis. This includes invoking the ast-grep (or sg) CLI for structural searching and replacement, and running the bundled build-graph.py (Python) and parse-js.mjs (Node.js) scripts to map code relationships and extract symbols.
[EXTERNAL_DOWNLOADS]: The documentation suggests installing the ast-grep CLI through standard package managers (pip, npm, brew, cargo) and requires the Node.js libraries acorn and acorn-walk to be present for JavaScript parsing.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it is designed to analyze project source code. 1. Ingestion points: The skill reads and parses code files provided in the user's project directory. 2. Boundary markers: No boundary markers or safety delimiters are used for the code being analyzed. 3. Capability inventory: The skill has capabilities for project-wide file reading and command execution for code analysis. 4. Sanitization: No sanitization or filtering of code content is performed, which could allow malicious instructions in code comments to influence the agent.

ast-code-graph