The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides shell instructions for the development lifecycle of extensions. This includes using npm link to connect local development builds, running build scripts (npm run build), and setting environment variables like ARC1_PLUGINS and SAP_ALLOW_PLUGIN_EXECUTE to test and load the developed plugins.
[DYNAMIC_EXECUTION]: The primary purpose of the skill is to guide the creation of dynamic plugins that are loaded into the server at runtime. It explains how to set the ARC1_PLUGINS environment variable to point to a local directory containing compiled JavaScript files (dist/index.js), which the host application then loads as extensions.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by scaffolding tools that process data from external SAP OData and ICF services.
Ingestion points: Data enters the agent context through ctx.http.get calls in the handler function of code-tier tools or via the response mapping in manifest-tier tools.
Boundary markers: The templates utilize zod for input schema validation in TypeScript and JSON schema definitions in manifest files to ensure input integrity.
Capability inventory: Scaffolds capabilities including network access to SAP endpoints (ctx.http) and the ability to execute ABAP console classes (ctx.run.classRun).
Sanitization: Relies on defined schemas for input validation and incorporates administrative opt-in safety gates (such as SAP_ALLOW_PLUGIN_RAW_WRITES) to control sensitive operations.

create-arc1-extension