The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates project management and deployment using standard development tools including npm, npx, lsof, and git. These operations are required for managing Node.js environments, building the frontend application, and deploying backend functions to Convex.
[EXTERNAL_DOWNLOADS]: The skill fetches the official Convex component catalog from convex.dev and references the convex-helpers utility library on GitHub. These downloads originate from the official vendor infrastructure and are used to provide the user with the most current documentation and tools.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes local configuration files and remote API outputs.
Ingestion points: Processes package.json, .openai/hosting.json, .env.local, and results from Sites hosting APIs (get_site, list_sites).
Boundary markers: While the skill follows strict procedural logic, it does not explicitly encapsulate all ingested data within markdown delimiters.
Capability inventory: Includes the ability to execute system commands (npm, npx), perform network operations (Sites publication), and write to the local file system.
Sanitization: The skill mitigates risks through mandatory structural validation (scripts/verify-project.sh) and a production bundle scanner (scripts/check-production-bundle.sh) that specifically rejects builds containing credential markers or unintended URLs.
[DATA_EXPOSURE_AND_EXFILTRATION]: The scripts/check-runtime.sh utility performs diagnostic reads of user shell profile files (e.g., ~/.zshrc, ~/.bashrc) to detect unsupported Node.js versions. This information is used solely for local troubleshooting, and the skill includes specific instructions for the agent to never print or exfiltrate credentials found during the development process.

codex-sites-convex