The Agent Skills Directory

[COMMAND_EXECUTION]: The smoke-test.mjs script utilizes child_process.spawn with shell: true to launch the application's development server. This command execution is influenced by parameters such as the proxy server URL and port numbers provided as command-line arguments.
[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting and processing data from developer-controlled files including package.json, d2.config.js, and GitHub Action workflows. As the instructions do not specify the use of boundary markers or input sanitization when reading these files, this creates an attack surface where an agent could potentially be influenced by instructions maliciously embedded in the project files.
Ingestion points: package.json, d2.config.js, yarn.lock, .github/workflows/*.yml.
Boundary markers: Not present.
Capability inventory: File system operations (rm, mkdir, cp), shell command execution (pnpm, node, gh, git), and network requests (fetch, Playwright navigation).
Sanitization: Not present.
[DATA_EXFILTRATION]: The included smoke-test.mjs utility handles authentication by sending credentials (username and password) to a targeted DHIS2 instance via a network request. While intended for local testing against development or demo servers, this pattern involves handling sensitive information. The skill mitigates broader risk by explicitly instructing the agent not to request production App Hub tokens in chat.
[DYNAMIC_EXECUTION]: The skill uses node -e commands to dynamically execute logic for tasks such as verifying Node.js version compatibility and extracting metadata from JSON configuration files during the migration process.

modernise-apps