The Agent Skills Directory

[SAFE]: The skill provides architectural guidance for adding capabilities (agents, jobs, chats, tools, views, and pages) to a specific application framework. It enforces a clear separation between sandboxed logic and server-side logic involving sensitive data.
[INDIRECT_PROMPT_INJECTION]: The skill instructions define data ingestion points for agents and tools. It mitigates injection risks by directing developers to use zod for input validation and zValidator for Hono routes, ensuring that external data is verified before processing.
[COMMAND_EXECUTION]: Standard development lifecycle commands are mentioned, such as npm test, npm run db:generate, and project-specific verification scripts like node scripts/verify.mjs check. These are restricted to local development and testing workflows.
[DATA_EXFILTRATION]: While the skill notes that server-side tools can access databases, the network, and secrets, this access is limited to the server runtime (server/src/tools/) and is presented as a standard part of the application's capability framework rather than a hidden exfiltration vector.

new-agent