The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references an unverifiable Node.js package in its usage examples.
Evidence: examples/usage.md includes an import statement for tauri-plugin-tauri-config. This package does not follow official Tauri naming conventions for core plugins and its source cannot be verified.
[INDIRECT_PROMPT_INJECTION]: The skill defines a configuration template that interpolates untrusted user data, creating a potential injection surface.
Ingestion points: templates/basic.md contains multiple placeholders such as {product_name}, {version}, and {dev_url} intended for user-supplied values.
Boundary markers: Absent. There are no delimiters or instructions provided to the agent to treat these values as untrusted or to ignore embedded instructions within them.
Capability inventory: examples/usage.md demonstrates the ability to invoke plugin commands and emit events, which could be manipulated if an attacker successfully injects malicious instructions through configuration fields.
Sanitization: Absent. The skill provides no guidance or logic for validating or escaping the values interpolated into the tauri.conf.json template.
[SAFE]: The skill references official documentation and packages from a well-known service.
Evidence: SKILL.md links to official Tauri documentation at v2.tauri.app. examples/usage.md references the official @tauri-apps/api package.

tauri-config