The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads browser binaries via npx playwright and the Vercel CLI at runtime during the preflight and walk stages.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands for repository management (git), GitHub CLI (gh) for PR interactions and API calls, and Vercel for on-demand deployments.
[DYNAMIC_EXECUTION]: The skill generates Javascript automation recipes at runtime and sends them to a worker devbox for execution via Playwright. This involves inlining code snippets into prompts sent to a separate execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted configuration and flow definitions from the target repository, particularly when triggered by a Pull Request. These YAML files contain natural language instructions in fields like expect that the agent interprets to judge flow success.
Ingestion points: Repository files (.flowchad/config.yml and .flowchad/flows/*.yml) and PR metadata.
Boundary markers: Absent; the subagent prompts for processing these files do not include explicit instructions to ignore potentially malicious embedded content.
Capability inventory: The agent possesses capabilities for shell execution, network access to third-party and internal APIs, and browser automation.
Sanitization: No sanitization or schema-based validation is performed on the natural language strings retrieved from the repository files before they are processed by the agent.

flowchad-runner