The Agent Skills Directory

[DYNAMIC_EXECUTION]: The templates/lib/db.ts file uses new Function to wrap dynamic import() calls for loading the @libsql/client and drizzle-orm/libsql modules. This pattern is explicitly intended to hide these dependencies from the Vercel bundler, effectively bypassing static analysis and security checks during the build process.
[COMMAND_EXECUTION]: In templates/lib/agent.ts, the skill uses node:child_process.spawn to execute various AI command-line tools like claude, codex, cursor, gemini, and opencode. The arguments for these processes, including prompts and schemas, are built from dynamic workflow inputs, which could allow for argument injection if the inputs are malicious.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data which is then used to author and update TypeScript workflows and database schemas, creating a vector for malicious instructions to influence the agent's behavior.
Ingestion points: The agent reads ICP and persona files from the workspace, processes external provider documentation, and accepts row data through API endpoints and CLI scripts.
Boundary markers: The instructions do not define delimiters or safety protocols to isolate external content when it is interpolated into agent prompts or generated code.
Capability inventory: The skill has extensive capabilities, including writing to the file system, applying database migrations, performing network operations, and executing shell commands.
Sanitization: Sanitization is minimal, relying on basic JSON stabilization and simple keyword-based SQL query validation for read-only checks.
[DYNAMIC_EXECUTION]: The API route in templates/server/api/run/[...workflow].ts dynamically constructs a workflowId from URL path parameters and executes it using the workflow SDK, which allows for the dynamic resolution and execution of logic based on unvalidated external strings.

gtm-workflow