The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's workflow involves reading .env files located within the templates/ directories to verify the presence of credentials such as GOOGLE_CLIENT_ID. This constitutes direct access to sensitive configuration data.\n- [COMMAND_EXECUTION]: The skill utilizes the bash tool to execute various shell commands, including starting development servers (pnpm dev), terminating processes (kill, lsof), and running code formatters (npx prettier). It also dynamically creates and manages child agents using the platform's Agent tool.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It reads file contents from the project directory (e.g., CLAUDE.md, application routes) and injects this untrusted data into the system prompt for spawned tester agents via the {{test_plan}} variable. Evidence Chain: 1. Ingestion points: templates/<app>/app/routes/, templates/<app>/CLAUDE.md, templates/<app>/server/routes/api/. 2. Boundary markers: Absent for interpolation. 3. Capability inventory: Sub-agents have access to bash for file system modification and full browser automation tools. 4. Sanitization: No filtering or escaping is performed on the ingested file content.\n- [DATA_EXFILTRATION]: Sensitive status information regarding credentials is passed to sub-agents. These agents are equipped with browser tools (browser_navigate, browser_fill_form, browser_network_requests) that could be exploited to exfiltrate information if the agent's logic is subverted via injected instructions.\n- [REMOTE_CODE_EXECUTION]: Tester agents are empowered to autonomously 'Fix the code' by modifying source files. Because the modified code is immediately executed by the dev server's Hot Module Replacement (HMR) process, this creates a risk of arbitrary code execution if the agent is compromised.

qa