The Agent Skills Directory

[COMMAND_EXECUTION]: The validate_backstage_plugin.py script executes standard development lifecycle commands (yarn lint, yarn tsc, yarn test, yarn build) and npm pack --dry-run. These operations are performed to validate the structure and quality of the scaffolded plugin. The commands are strictly limited to a hardcoded whitelist of script names to prevent the execution of arbitrary scripts defined in a package.json file.
[EXTERNAL_DOWNLOADS]: The validate_official_docs.py script performs HTTP GET requests to official Backstage documentation sites on backstage.io and GitHub. These checks are used to ensure that the agent is providing recommendations based on the most current official guidance and do not involve sending sensitive data or downloading executable code.
[DYNAMIC_EXECUTION]: The test_validate_backstage_plugin.py script uses Python's importlib to dynamically load and execute the validate_backstage_plugin.py script for unit testing purposes. This is a standard testing practice using local, static file paths.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and process plugin source code and configuration files provided by the user.
Ingestion points: Plugin source files and package.json are read by scripts/validate_backstage_plugin.py to determine the plugin type and run validation scripts.
Boundary markers: The skill documentation explicitly instructs the agent to validate all recommendations against official documentation sources.
Capability inventory: The skill can write planning artifacts to the filesystem and execute whitelisted shell commands via Yarn/NPM.
Sanitization: Inputs to shell commands are restricted to a predefined list of allowed development scripts, mitigating the risk of malicious instructions within the analyzed files triggering unauthorized actions.

backstage-plugin-builder