The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands such as npx, pnpm, npm, and node to manage the application lifecycle, including scaffolding new projects (agent-native create), installing dependencies, and running local development servers. These operations are core to the skill's purpose as an application builder.
[DYNAMIC_EXECUTION]: The skill generates a specific JavaScript file (shoot.mjs) and executes it using node to perform automated UI verification via Playwright. This dynamic execution is bounded to the project's temporary directory and used for visual regression testing.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, potentially attacker-controlled sources such as spreadsheets and third-party project transcripts. However, the instructions explicitly command the agent to treat this content as untrusted data and prevent it from being executed as instructions.
[EXTERNAL_DOWNLOADS]: The skill downloads project dependencies and browser binaries (playwright, chromium) from the official NPM registry and Playwright's distribution servers to support its UI review features.
[CREDENTIALS_UNSAFE]: While the skill mentions the use of API keys and environment variables like AUTH_DISABLED, it provides robust security guidance, instructing users and agents to store these only in ignored .env files and explicitly warning against committing or deploying them.

turn-into-app