The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data to generate complex application configurations, backend definitions, and frontend code.
Ingestion points: The skill ingests untrusted data during Phase 0-1 (Requirement Hearing) and via user-supplied requirements documents as described in SKILL.md and references/feature-mapping.md.
Boundary markers: The skill explicitly instructs the agent to use the AskUserQuestion tool for all requirements gathering and mandates human confirmation before any write operations are executed (SKILL.md: "書き込み操作は必ず実行前にユーザーに確認する").
Capability inventory: The skill utilizes powerful Admin MCP tools such as topics_group-create for schema modification and KurocoFront-deploy for remote code deployment.
Sanitization: The skill includes a mandatory Phase 5 (Final Security Audit) that uses the /kuroco-security-audit skill to verify all configurations and permissions before final deployment.
[COMMAND_EXECUTION]: The skill orchestrates various platform-level tools to manage the CMS backend and deployment pipeline.
The agent is instructed to use tools like site-backup, topics_group-create, api-openapi_data, and KurocoFront-deploy.
These operations are legitimate and central to the skill's primary purpose as an application builder for the Kuroco platform, and they require explicit user approval as per the provided instructions.
[EXTERNAL_DOWNLOADS]: The skill recommends and integrates with well-known, industry-standard web development frameworks and services.
Frameworks mentioned for project initialization include Next.js, Nuxt, Vue, React, and Vite.
Integration with services like GitHub, Vercel, and Netlify is described for hosting and CI/CD purposes.
These references target trusted or well-known services and do not involve untrusted third-party scripts or packages.

kuroco-app-builder