The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using standard development tools. This includes running npx @bookshop/generate to produce site structures, npx @bookshop/init to scaffold new components, and npx @bookshop/up to perform framework-wide upgrades.
[EXTERNAL_DOWNLOADS]: The instructions involve downloading and installing official vendor-owned resources. This includes various @bookshop/* packages, the @cloudcannon/editable-regions integration, and Hugo modules from github.com/cloudcannon/bookshop. These are necessary dependencies for the framework's functionality and migration path.
[INDIRECT_PROMPT_INJECTION]: The skill operates on a variety of project files that constitute an attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to read and process component specifications (*.bookshop.yml), site configurations (cloudcannon.config.yml, package.json), front matter in content files, and SSG-specific templates (Astro, Hugo, Eleventy).
Boundary markers: There are no explicit instructions for using delimiters or boundary markers to isolate untrusted data found within these project files from the agent's core instructions.
Capability inventory: The skill requires the ability to read and modify the file system (moving components, rewriting configuration) and execute shell commands for building and generating site metadata.
Sanitization: The instructions do not specify any sanitization or validation logic for the content ingested from the codebase, relying on the agent to interpret the data as-is for the migration process.

cloudcannon-bookshop