The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled utility script scripts/validate.py uses subprocess.run() to invoke node or nodejs for ECMAScript regex validation. This is a controlled execution of a local system utility used specifically to verify that generated regex patterns are compatible with the target server's engine.
[DYNAMIC_EXECUTION]: The validation script dynamically generates a small Javascript snippet at runtime to perform regex syntax checks. The user-influenced input is sanitized using json.dumps() before being embedded into the Javascript code, which prevents command injection into the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural language input to generate complex JSON routing policies. A malicious description could potentially influence the generated routing logic. The skill mitigates this by:
Ingestion points: The user's routing intent description (processed in SKILL.md Step 1).
Boundary markers: While explicit delimiters for user input are not detailed, the skill provides extensive instructions on safe prompt authoring and intent classification.
Capability inventory: The agent writes a local file (router.json) and executes a bundled script (scripts/validate.py) which spawns a node subprocess.
Sanitization: The validation script includes checks for potentially problematic prompt instructions and uses proper escaping (json.dumps) when testing regex patterns.
[SAFE]: The skill follows security best practices by instructing the agent to print server interaction commands for the user to copy and run manually, rather than executing live API calls or network operations itself. It also provides a comprehensive set of instructions for users to verify the routing logic independently.

lemonade-router-builder