The Agent Skills Directory

[SAFE]: The skill's behavior is consistent with its stated purpose of documenting architectural flows. While it interacts with the local filesystem, these actions are scoped to discovering and creating documentation within an EventCatalog project environment and use specialized platform tools.
[INDIRECT_PROMPT_INJECTION]: The skill documents architectural flows by scanning existing resource metadata, which represents a potential surface for indirect prompt injection if that data contains malicious instructions. However, this is the core intended functionality and is considered safe in this context.
Ingestion points: The skill scans eventcatalog.config.js and directories such as services/, agents/, events/, domains/, and flows/ to inventory existing resource metadata.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands within the user's project files during the scanning phase.
Capability inventory: The skill can read local files via specific MCP tools (getResources, getResource) and has the capability to write new flow documentation files (index.mdx) to the project structure.
Sanitization: The instructions do not describe sanitization or validation of the retrieved metadata (such as resource IDs or summaries) before it is included in the generated flow documentation.

flow-wizard