The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to write instructions to AGENTS.md and CLAUDE.md that include 'pre-approvals' for critical tasks. Specifically, it tells the agent to 'Proceed without asking' when executing deployment plans and repository pushes, which directly overrides standard AI safety protocols requiring user confirmation for potentially dangerous actions.
[PERSISTENCE]: The workflow modifies the project's root configuration files (AGENTS.md and CLAUDE.md) to store these pre-approval instructions. This ensures the reduced safety oversight persists across different chat sessions and future interactions with the agent in that project.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of multiple external 'stage skills' from GitHub repositories using the npx skills add command. While many sources are well-known organizations (Vercel, Microsoft), this mechanism allows for the bulk installation and execution of remote code within the agent's environment.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to interact with development tools, including GitHub CLI (gh repo create), Cloudflare Wrangler (npx wrangler whoami), and Supabase CLI (supabase orgs list). It also manages repository pushes and CI/CD monitoring.
[INDIRECT_PROMPT_INJECTION]: The skill ingests a user-provided 'application idea' which is then used to generate product specifications, designs, and deployment plans. This creates a surface where a malicious idea could potentially manipulate the generated technical plan, made more risky by the 'pre-approval' instructions that bypass user review.
Ingestion points: Application ideas provided by the user in the initial prompt or chat history (Step 2 of executing-mvp-build.md).
Boundary markers: The skill includes a 'confirmation table' (Step 4.4) where all decisions and answers are shown to the user for approval before the main build begins.
Capability inventory: File system writes (AGENTS.md, CLAUDE.md), multiple shell command executions via various CLIs, and repository management.
Sanitization: No explicit sanitization of the user-provided idea is mentioned before it is interpolated into the workflow stages.
[DYNAMIC_EXECUTION]: The skill implements a 'discovery' mechanism that scans local and user-level directories (e.g., ~/.cursor/skills/, .agents/skills/) to find and load other skills by their unique identifiers (IDs) or names at runtime.

building-mvp