The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests repository context and file content, which could contain untrusted data. * Ingestion points: Reads current file, selection, and repository context in SKILL.md. * Boundary markers: Implements a manual review step where the user must explicitly reply "OPEN" and an automated validation step for the agent. * Capability inventory: Network capability to open a URL in the browser via the open-browser tool or equivalent mechanism. * Sanitization: Explicitly instructs the agent to exclude secrets, private tokens, and internal paths from the generated prompt before transmission.
[DATA_EXFILTRATION]: The skill facilitates the transfer of repository-related prompts to v0.dev, which is a well-known service operated by Vercel. This behavior is documented neutrally as it involves a well-known service and is mitigated by a mandatory human-in-the-loop validation process and explicit instructions to remove sensitive credentials and tokens before the URL is opened.

use-v0