The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes reference documents (e.g., references/architecture-health-metrics.md, references/dependency-analysis-patterns.md) that provide shell script templates and CLI commands. These are intended to be used by the agent to run static analysis tools such as madge, cloc, and knip to generate metrics on file size, circular dependencies, and coupling. These operations are local and consistent with the architectural analysis role.
[EXTERNAL_DOWNLOADS]: The documentation suggests executing various analysis tools using npx (e.g., npx madge, npx depcruise). These commands fetch packages from the official NPM registry, which is a well-known and standard service for software development. This behavior is documented neutrally as part of the tool's diagnostic capabilities.
[DATA_EXPOSURE]: To perform its duties, the agent is designed to read the project's directory structure and source code files (e.g., src/**/*.ts). This is a legitimate data access pattern required to identify 'God Classes' and map the system's dependency graph. There is no evidence of this data being sent to unauthorized external endpoints.
[PROMPT_INJECTION]: The skill exhibits a surface area for indirect prompt injection because it ingests and processes untrusted data in the form of local source code. Malicious instructions could be embedded within comments or strings in the files being analyzed. However, the skill's primary focus is on structural analysis rather than code execution, and it maintains clear operational boundaries.

Atlas