The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided blueprints, user stories, and existing application source code, creating a potential surface for indirect injection.
Ingestion points: The skill reads blueprint.json and existing AirApp files in maintenance mode.
Boundary markers: The documentation in references/maintenance.md explicitly instructs the agent to treat existing files as untrusted data rather than instructions.
Capability inventory: The skill can execute commands via npm and node, write files to the local filesystem, and propose changes to the Busabase workspace.
Sanitization: A specialized utility (scripts/airapp-kit.mjs) validates the structure and content of blueprints against a strict schema.
[COMMAND_EXECUTION]: The skill utilizes Node.js execFile to run validation and build tasks during the scaffolding process.
Evidence: scripts/airapp-kit.mjs executes npm view, npm install, and node --eval to verify SDK exports and environment readiness.
[EXTERNAL_DOWNLOADS]: The skill downloads dependencies from official registries and installs templates from provided URLs.
Evidence: The scaffolding process uses npm install to fetch busabase-sdk, hono, and other dependencies. The busabase-cli tool is used to install templates from user-supplied repository URLs.

busabase-app-creator