The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The package.json and package-lock.json files in the infra/apps/website/ directory include version numbers for widely used libraries that are significantly ahead of current stable releases (e.g., next@16.3.7, typescript@7.0.2, lucide-react@1.49.0, tailwind-merge@3.7.0). These versions do not currently exist on the public NPM registry, creating a high risk for dependency confusion attacks where an attacker could register these versions to execute malicious code during the build process.
[REMOTE_CODE_EXECUTION]: The project is configured to install and execute unverifiable package versions from the public registry during the npm install and build phases, which allows for arbitrary code execution if those versions are compromised or registered by malicious actors.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and recreate content from external sources such as live websites and brand guides. This represents an attack surface for indirect prompt injection, where malicious instructions could be embedded in the data the agent processes, although the skill includes instructions to treat this material as data.
[DYNAMIC_EXECUTION]: The evals/contract.mjs script uses dynamic import() calls to load and evaluate all TypeScript resource files within the infra/ directory, which involves executing code from computed file paths.
[COMMAND_EXECUTION]: The skill workflow requires the agent to execute several shell commands, including package installation, Next.js build scripts, and Cargo CDK deployment commands, which are necessary for its functionality but inherit the risks of the supplied dependencies.

website-building