The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/watch-build.mjs script utilizes node:child_process.spawn with shell: true to execute build commands provided by the user via the --build-cmd flag. This allows for arbitrary shell command execution within the project environment.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to rely on the output of cloudcannon configure detect-build-commands, which parses project files such as package.json. A malicious repository could supply a craft package.json with a harmful build script that the agent might then recommend executing.
Ingestion points: Project configuration files (package.json, cloudcannon.config.yml) parsed by the CloudCannon CLI and referenced by the agent.
Boundary markers: No explicit delimiters or warnings are used when processing the detected build commands before presenting them to the user.
Capability inventory: Execution of shell commands via spawn in watch-build.mjs and general command line recommendations.
Sanitization: There is no evidence of sanitization or validation of the build command strings detected from the project files.
[EXTERNAL_DOWNLOADS]: The setup instructions direct users to install the @cloudcannon/cli package globally via npm. This is a recognized official tool from the skill's author.
[DYNAMIC_EXECUTION]: The watch-build.mjs script performs dynamic execution of command strings at runtime to satisfy its build-on-change functionality.

cloudcannon-dev-server