The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by directing the agent to ingest and act upon instructions found within untrusted repository content.
Ingestion points: Step 2 (SKILL.md) instructs the agent to "Read repository instruction files" and "package scripts" to derive configuration commands.
Boundary markers: There are no boundary markers or instructions provided to the agent to treat repository content as untrusted or to ignore embedded directives that might attempt to override safety guidelines.
Capability inventory: The skill utilizes the sc CLI to set and run commands, and explicitly calls for the execution of shell commands derived from the environment.
Sanitization: No sanitization or validation logic is defined to check the safety of the derived commands before they are executed in Step 4.
[COMMAND_EXECUTION]: The skill executes dynamically generated commands based on strings parsed from the local repository environment.
Evidence: Step 4.2 ("Run the setup command once") and Step 4.3 ("Start the configured target through sc project scripts run <name>") execute arbitrary strings derived from repository manifests (e.g., package.json) and user-provided instruction files.
[EXTERNAL_DOWNLOADS]: The skill encourages the execution of package manager commands which fetch external dependencies.
Evidence: Step 2 suggests deriving commands like pnpm install --frozen-lockfile or npm ci, which involve downloading packages from external registries.

setup-superconductor-project