The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user to execute shell commands to install necessary dependencies and configure the environment.
npm install @cloudinary-util/url-loader in references/cdn-integration.md.
npx astro add sharp in references/image-component.md and references/templates/image-setup.md.
npm install satori @resvg/resvg-js and npm install satori sharp in references/og-satori.md.
[INDIRECT_PROMPT_INJECTION]: The skill provides an example implementation of an API route that ingests untrusted user data without explicit sanitization patterns, creating a vulnerability surface.
Ingestion points: The file references/remote-images.md contains an API route snippet (src/pages/api/thumbnail.ts) that retrieves a src parameter directly from url.searchParams.
Boundary markers: None are present in the code snippet to delimit or validate the input.
Capability inventory: The ingested src is passed to the getImage() utility, which is capable of fetching remote assets or reading local image files.
Sanitization: No input validation, hostname checking, or path sanitization is demonstrated in the implementation example.
[SAFE]: Integration with well-known services and libraries (Cloudinary, Imgix, Vercel's Satori, Astro Sharp) follows standard practices and uses official or community-accepted packages.

astro-assets