The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill specifies versions for core dependencies that do not exist in the current ecosystem, such as Laravel 13 (described as 'stable 13.33') and TypeScript 7.0. It specifically instructs users to use npm aliases pointing to an unofficial scope (@typescript/typescript6, @typescript/native) rather than the official typescript package maintained by Microsoft. This pattern is highly characteristic of supply chain attacks, such as package typosquatting or dependency confusion, where attackers register future-versioned or similarly-named packages to intercept installations.
[COMMAND_EXECUTION]: The provided instructions and templates include various shell commands for project scaffolding and management. These include directory creation with mkdir -p, Laravel service management via php artisan, and PHP dependency management with composer dump-autoload. While common in development, these commands allow the agent to interact with the host system's file structure and execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow (fuse-ai-pilot:explore-codebase) requires the agent to analyze the project's existing codebase in the /FuseCore/ directory. This creates a surface where an attacker could embed malicious instructions in code or configuration files that the agent might ingest and follow.
Ingestion points: Found in SKILL.md under the 'Agent Workflow' section where it instructs to 'Analyze existing modules'.
Boundary markers: There are no explicit delimiters or instructions provided to treat content from the analyzed files as untrusted or to ignore embedded agent instructions.
Capability inventory: The skill possesses capabilities for system command execution (mkdir, php artisan), file writing, and network operations (via fetch in the React templates).
Sanitization: No sanitization, validation, or filtering of the content analyzed from the codebase is specified.

fusecore