The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell scripts located within the skill's directory (scripts/init-artifact.sh and scripts/bundle-artifact.sh) to initialize projects and bundle code.
[EXTERNAL_DOWNLOADS]: The initialization and bundling processes involve downloading and installing several standard Node.js packages from the npm registry, including parcel, @parcel/config-default, parcel-resolver-tspaths, and html-inline.
[INDIRECT_PROMPT_INJECTION]: The skill manages a workflow where code generated by the agent is bundled into a single HTML file for rendering. This creates a vulnerability surface where instructions or malicious scripts embedded in the generated frontend code could be executed in the user's browser or influence the agent's behavior.
Ingestion points: Source files (React/TypeScript) generated or modified by the agent in the project directory created via SKILL.md instructions.
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the generated content.
Capability inventory: Includes shell execution (bash), package management (npm), and file bundling.
Sanitization: No validation or sanitization is performed on the generated code before it is bundled into the final bundle.html artifact.

artifacts-builder