The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill manages its own environment by installing several standard Node.js packages into local cache directories (~/.cache/). These include ajv for JSON Schema validation, qrcode for generating device testing links, and playwright for headless browser rendering. These packages are well-known industry standards and are retrieved from the official NPM registry.
[COMMAND_EXECUTION]: The skill relies on executing system commands to provide core functionality, such as generating screen previews and HTML visualization maps. Scripts like canvas.py, shoot.sh, and mobile-preview.mjs use subprocess.run (Python) or spawnSync (Node.js) to call the official Adapty CLI and system-installed browsers (e.g., Chrome/Chromium). These commands are constrained to processing local data and opening local files, aligning with the skill's primary purpose of providing developer feedback.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted flow configuration data (JSON), which presents a theoretical surface for indirect prompt injection.
Ingestion points: Data enters the system context via user-provided or fetched JSON files (e.g., draft.json or flow.working.json) that are parsed by the flowkit.py, localization.py, and snippet.py scripts.
Boundary markers: The skill enforces a structured multi-phase workflow where every configuration must pass three distinct validation gates (local referential integrity, schema compliance, and API-level validation) before the user is asked for approval to write back to the live service.
Capability inventory: The skill is capable of performing file writes, network synchronization via the CLI, and launching local sub-processes for rendering and data visualization.
Sanitization: The skill uses standard JSON libraries (json.load, JSON.parse) and CLI utilities like jq to ensure data is handled as structured values rather than executable code, significantly mitigating the risk of malicious payload execution.

flow-generator