The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npm install to fetch @bpmn-io/form-json-schema, ajv, and ajv-errors. These are official and well-known packages within the Camunda and BPMN ecosystem, presenting no security risk.
[COMMAND_EXECUTION]: Instructions include the use of shell commands (cat, node, npm) to create and run a local validation script. These operations are transparent, limited to the project directory, and serve a legitimate developer purpose.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of user-facing form labels and descriptions. While this is a common surface for indirect injection, the skill's specific focus on Camunda's schema structure and its use of standard validation tools makes it benign in this context.

camunda-forms