The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation and example files include hardcoded placeholder strings for secrets and passwords used for code demonstration.
plugins/jwt.md, references/cookie.md, and examples/cookie.ts: Contain an example secret string 'Fischl von Luftschloss Narfidort'.
integrations/react-email.md: Includes a placeholder password '12345678' in a nodemailer transport configuration example.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of numerous packages from the Bun and NPM registries, including core framework components, established validation libraries, and community-maintained integrations.
Core framework components: @elysiajs/bearer, @elysiajs/cors, @elysiajs/cron, @elysiajs/jwt, @elysiajs/openapi, etc.
Integration libraries: zod, valibot, prisma, drizzle-orm, react-email, and various @opentelemetry/* packages.
Vendor resources: The prismabox package is distributed by the skill's author, fellipeutaka.
[COMMAND_EXECUTION]: The instructions provide various shell commands for project scaffolding, dependency management, and multi-platform deployment.
Setup and execution: bun create elysia app, wrangler init, deno serve, bun email.
Package management: bun add, pnpm add, npm add.
Build and deployment: bun build --compile, docker build, vc deploy.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-defined requirements to generate or modify server logic, creating an attack surface where untrusted inputs could potentially influence the security of the resulting code.
Ingestion points: User requirements for creating routes, validation schemas, and plugin configurations in SKILL.md.
Boundary markers: Not explicitly defined in the instruction set to isolate user inputs from the agent's core instructions.
Capability inventory: The agent has extensive file-writing and shell execution capabilities for application setup and deployment.
Sanitization: The skill proactively recommends security measures such as using fileType() for file validation and the safe attribute in JSX/HTML to mitigate cross-site scripting (XSS) and other runtime injection vectors.

elysiajs