The Agent Skills Directory

[DYNAMIC_EXECUTION]: The browser initialization documentation in references/platform-init.md provides code that fetches version metadata from jsDelivr and dynamically injects a <script> tag into the document head to load and execute the SDK, which creates an unverified execution path at runtime.
[EXTERNAL_DOWNLOADS]: The skill relies on external delivery of its SDK through npm and public CDNs like jsDelivr and unpkg. It also fetches package metadata from the jsDelivr API to determine the latest version.
[DATA_EXFILTRATION]: The skill instructs users to connect to https://api.codenow.cn for REST operations. This domain is currently blacklisted by security scanners (URLite), posing a risk to any sensitive database credentials or data transmitted to this endpoint.
[INDIRECT_PROMPT_INJECTION]: The skill encourages the agent to ingest external schema data via bmob-mcp before generating code, creating a vector for potential injection if the tool output is compromised.
Ingestion points: Schema data returned from the get_project_tables tool call.
Boundary markers: None provided in the prompt instructions to delimit the external schema data.
Capability inventory: Database CRUD operations via Bmob.Query, user authentication via Bmob.User, and file management via Bmob.File.
Sanitization: No validation or sanitization of the schema data is performed before it is used to structure generated database queries.

bmob-database-javascript