The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/research-idea.mjs file performs network requests to fetch research data from well-known public domains.
Evidence: Fetches top-of-day posts from www.reddit.com and trending topics from trends.google.com. These operations are consistent with the skill's stated purpose of conducting market research.
[PROMPT_INJECTION]: The skill incorporates external, untrusted data into its research workflow, which is an inherent part of its primary function.
Ingestion points: The scripts/research-idea.mjs script retrieves Reddit post titles and Google Trends topics.
Boundary markers: Untrusted content is structured within Markdown table rows in the generated idea-brief.md file.
Capability inventory: The agent can write files, execute shell commands for scaffolding and auditing, and perform network requests to specific domains.
Sanitization: The script performs standard HTML entity decoding but does not implement specific filtering to sanitize retrieved text for potential agent instructions. The risk is considered minimal given the context of generating research summaries.
[COMMAND_EXECUTION]: The skill relies on standard shell commands to execute its internal scripts and development tools.
Evidence: The SKILL.md and templates/prompts.md files provide instructions for running node scripts/research-idea.mjs, node scripts/audit-webapp.mjs, and common scaffolding commands like npm create next-app. These are necessary for the skill's operational stages.

vibe-code-webapp