The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as npx convex dev and npx tsc --noEmit to initialize the backend and verify code correctness. These commands are part of the standard development workflow for the Convex platform.
[EXTERNAL_DOWNLOADS]: The workflow involves fetching a template recipe (quickstart-recipe@^2) from the vendor's repository to scaffold the application. This is an intended function of the skill using vendor-managed resources.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided ideas and templates to generate code. To mitigate risks associated with untrusted input, it enforces strict coding standards, such as mandatory use of specific imports from ./_generated/server and ./_generated/api, and restrictions on Node.js built-in modules to prevent unauthorized system access.
Ingestion points: User input {idea, template} in SKILL.md.
Boundary markers: Absent for the user-provided idea.
Capability inventory: File system write access for project scaffolding and shell command execution via npx (as described in SKILL.md).
Sanitization: The skill provides a comprehensive set of rules for backend code generation (e.g., query/mutation naming, import restrictions, and data access patterns) which restricts the agent's output behavior.

convex-quickstart