The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple helper scripts included in the skill (e.g., datocms-import-wordpress.mjs, datocms-import-contentful.mjs, datocms-release.mjs) use node:child_process.spawnSync to execute npx datocms commands. These scripts pass arguments to the shell that are derived from environment variables, project files, and user input.
[CREDENTIALS_UNSAFE]: The scripts datocms-import-wordpress.mjs and datocms-import-contentful.mjs pass sensitive credentials (WORDPRESS_PASSWORD, CONTENTFUL_TOKEN, CONTENTFUL_SPACE_ID) as plaintext command-line arguments. This represents a security risk as it can expose secrets to other users or processes on the system via process listings (e.g., ps commands).
[DYNAMIC_EXECUTION]: The datocms-sync-webhooks.mjs and datocms-sync-build-triggers.mjs scripts use dynamic import() to load and execute logic from project configuration files (e.g., datocms-webhooks.config.mjs) at paths specified via the --config command-line parameter.
[PROMPT_INJECTION]: Instructions in SKILL.md and several recipe files (such as cli-bootstrap/recipe.md and content-link/recipe.md) direct the agent to perform project inspections "silently" and to automate complex setup steps without manual user intervention or per-step confirmation, which can reduce transparency into the changes being applied to the repository.

datocms-setup