The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several command-line tools (hvigorw, ohpm, hdc) to build, manage, and deploy HarmonyOS applications. These tools involve executing shell commands on the host system and the target device, including starting activities (aa start) and managing packages (bm install).
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it parses project configuration files and uses their contents as arguments in shell commands.
Ingestion points: The skill reads metadata from AppScope/app.json5, build-profile.json5, and various module.json5 files within the project structure.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat data from these files as untrusted or to ignore embedded instructions.
Capability inventory: The skill possesses the capability to execute shell commands on the local machine and the connected HarmonyOS device, transfer files, and install/uninstall software.
Sanitization: No sanitization or validation is applied to variables such as bundleName or filenames before they are interpolated into shell strings like hdc shell "aa start ... -b <bundleName>".
[DYNAMIC_EXECUTION]: A Python script snippet is included in references/device-installation.md to dynamically inspect HarmonyOS build artifacts. The script uses the zipfile and json libraries to read internal configuration from .hap and .hsp files found in the outputs/ directory.

harmonyos-build-deploy