The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The guide identifies a potential attack surface where agent adapters parse output from LLM-driven processes that may have ingested malicious external data. It provides proactive mitigation strategies for this vulnerability.
Ingestion points: server/parse.ts (parses sub-agent stdout).
Boundary markers: Encourages the use of structured agentConfigurationDoc for routing logic and intent matching.
Capability inventory: Includes runChildProcess for system-level execution, fetch for network requests, and fs.symlink for managing skill directories.
Sanitization: The documentation explicitly mandates treating agent output as untrusted, using safe extraction helpers (e.g., asString), and avoiding the use of eval() on agent output.
[COMMAND_EXECUTION]: The documentation describes the implementation of runChildProcess to facilitate the execution of local agent CLI tools, which is the primary intended function of the framework's adapter system.
[CREDENTIALS_UNSAFE]: The guide discusses the management of sensitive credentials like GALYARDER_API_KEY and ANTHROPIC_API_KEY. It promotes security best practices by instructing developers to inject these via environment variables rather than prompt templates and to utilize the redactEnvForLogs helper to mask secrets in metadata logs.

create-agent-adapter