The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted JSON schemas provided by users to generate UI components and implementation code. This ingestion of external data creates a surface for indirect prompt injection, where malicious instructions could be embedded within the schema to influence the agent's behavior during the build or deployment process.
Ingestion points: User-provided JSON schema processed via instructions in SKILL.md.
Boundary markers: Absent.
Capability inventory: Local repository edits (file writes) and network API operations (PATCH /api/projects/:uuid/envs, POST /api/projects/:uuid/deploy) across the skill instructions.
Sanitization: No explicit validation or sanitization of the schema content is mentioned before processing.
[DATA_EXFILTRATION]: The skill is designed to access sensitive configuration data from ~/.build-host/credentials.json to facilitate authenticated API calls. Although this is standard for service-specific tools, accessing credential files in the home directory is a high-privilege operation. The skill body includes explicit safety rules to prevent the output or printing of these credentials.
[COMMAND_EXECUTION]: The skill is authorized to perform local repository modifications and execute network-based API calls for managing project environments and deployments. These actions are aligned with the skill's stated purpose but require consistent user oversight due to their impact on the codebase and deployment state.

crud-from-schema