The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements an instruction resolution mechanism that ingests untrusted data from the local repository.
Ingestion points: The script scripts/resolve.py reads project-specific configuration from .agents/skills-config/nextjs-application-performance/config.yaml and associated profile markdown files.
Boundary markers: While the script separates sections with headers (e.g., ## Project Instructions), it does not include explicit delimiters or instructions for the agent to ignore potentially malicious embedded commands or directives within the user-provided configuration.
Capability inventory: The agent is granted the ability to read and write files, and is specifically instructed in SKILL.md to execute commands (e.g., validate) defined within the resolved configuration.
Sanitization: User-provided configuration text and command strings are interpolated directly into the final instruction set without escaping or verification, which could allow an attacker to override agent behavior via repository-stored data.
[COMMAND_EXECUTION]: The skill architecture is designed to facilitate the execution of arbitrary shell commands defined in the project configuration.
The SKILL.md file instructs the agent to "Run... configured static, type, integration, browser, and E2E checks."
These commands are retrieved dynamically from the repository's config.yaml by the resolve.py script and presented to the agent as authoritative instructions.
[EXTERNAL_DOWNLOADS]: The skill uses uv run to execute its Python components.
This tool may automatically download and install Python interpreters or dependencies required for the resolution script, though this is typical for development-oriented agent skills and uses standard Python infrastructure.

nextjs-application-performance