The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npm install and npx --yes busabase-cli@latest to download verified vendor packages and command-line tools from the official npm registry during scaffolding and maintenance tasks.
[COMMAND_EXECUTION]: The airapp-kit.mjs script uses node:child_process.execFile to automate project setup, including installing Node.js dependencies and building application bundles with esbuild.
[INDIRECT_PROMPT_INJECTION]: The applications generated by this skill are designed to ingest and display record data from external Busabase Bases, which represents a known attack surface (Attack Vector 8c).
Ingestion points: Records are fetched from Busabase via app/js/providers/busabase-provider.js and the site-worker.js Cloudflare Worker.
Boundary markers: The skill instructions advise the agent to explicitly reference and follow named workflow skills to maintain context.
Capability inventory: Scaffolding scripts possess file system write permissions and the ability to execute local subprocesses.
Sanitization: The skill includes deterministic validation checks to ensure no secrets or unauthorized procedures are included in the generated application source.
[DYNAMIC_EXECUTION]: The scaffolding logic dynamically executes a JavaScript string using node --eval to verify the presence of required exports in the installed SDK. Furthermore, the skill supports 'pointer stubs' which fetch skill instructions from remote Busabase nodes at runtime via the CLI.

busabase-app-creator