The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes project source code, requirements files, and user-provided ideas to generate implementation plans.
Ingestion points: The skill scans the project's repo_root for branding and stack identification and reads untrusted data from requirements.md, billing.md, and site.json.
Boundary markers: The skill mitigates this risk by requiring the agent to write plans to tasks.md and wait for explicit human 'Approval' for any high-risk or high-effort actions.
Capability inventory: The agent is granted capabilities to modify project code, execute deployment commands (GitHub, Vercel), and delete specific local directories.
Sanitization: No specific input sanitization or escaping is mentioned, but the human-in-the-loop confirmation model provides a significant barrier to automated exploitation.
[COMMAND_EXECUTION]: The skill uses various command-line interfaces (npm, pnpm, yarn, gh, vercel) to facilitate project initialization, building, and deployment. These operations are the primary function of the skill and are consistently gated by instructions to seek user confirmation before execution.
[DYNAMIC_EXECUTION]: The skill executes a bundled Python script (scripts/auto_archive.py) to handle directory management. Analysis of the script shows it is restricted to moving directories within a specific runs/ or openspec/ structure and includes validation logic to prevent arbitrary path manipulation.
[SAFE]: The skill explicitly instructs the agent to avoid writing secret values to logs and to use environment variables for sensitive data like Stripe webhook secrets or Supabase keys, adhering to security best practices.

workflow-ship-faster