The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The build script (scripts/build-presets.mjs) uses npm exec to download and run the esbuild-wasm bundler.
Evidence: The script defines const BUNDLER = 'esbuild-wasm@0.25.12'; and executes it via npm.
Description: It fetches a version-pinned, well-known industry tool from the npm registry to process the generated scripts.
[COMMAND_EXECUTION]: The skill invokes shell commands to build the generated presets.
Evidence: node <skill-directory>/scripts/build-presets.mjs is executed as part of the workflow.
Description: The script internally spawns npm to run the bundler within a controlled temporary workspace.
[DYNAMIC_EXECUTION]: The skill generates JavaScript code and bundles it into a distribution artifact.
Evidence: The buildModule function in scripts/build-presets.mjs reads generated entry points and outputs a bundled file.
Description: The script includes extensive security checks to verify that only local ESM modules within the allowed directory are included in the final bundle, effectively preventing path traversal or external dependency inclusion.
[INDIRECT_PROMPT_INJECTION]: The skill processes project source code and SDK declarations, creating a potential surface for indirect prompt injection.
Ingestion points: Reads SDK declarations, bridge contracts, and application source code to resolve identifiers (as seen in SKILL.md generation rules).
Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded prompts within the ingested source code.
Capability inventory: The skill has the ability to write JavaScript files to the project directory and execute a build script that uses npm.
Sanitization: The skill's build script performs strict path validation and module format checking to ensure that the resulting bundle only contains intended local content.

to-android-presets