The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on the bench CLI for all operations. Instructions in references/bench-operations.md and references/site-management.md guide the agent to perform administrative tasks, including site creation, migration, and destructive actions like bench drop-site.
[CREDENTIALS_UNSAFE]: The agent is instructed to manage sensitive database and administrative credentials. Evidence in references/site-management.md shows the agent being told to store the database root password in the global configuration using bench set-config -g root_password '<pwd>' and to pass it via CLI flags.
[REMOTE_CODE_EXECUTION]: The skill utilizes the bench execute and bench console commands, which allow the agent to run arbitrary Python code or interactive sessions with full site context. This capability can be exploited to execute malicious logic on the host system.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8).
Ingestion points: The agent is instructed to read and analyze existing application code in references/existing-app.md to understand patterns.
Boundary markers: There are no instructions to use delimiters or ignore embedded instructions when reading existing project files.
Capability inventory: The agent has extensive capabilities including file system modification, shell command execution via bench, and arbitrary Python execution via bench execute.
Sanitization: No sanitization or validation of the untrusted code content is required before the agent processes it.

frappe-dev