The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection by displaying content from external data sources.
Ingestion points: The UI component displays message strings received from external WebSocket and SSE events (e.g., oauth_required, warning, error).
Boundary markers: The instructions do not specify any delimiters or safety warnings for the agent when displaying these externally-sourced messages.
Capability inventory: The skill environment has capabilities for network operations (REST API, WebSocket), file system access (writing iblai.env), and command execution (pnpm, playwright).
Sanitization: There is no mention of sanitizing or escaping the message content received from the backend before it is rendered to the user.
[EXTERNAL_DOWNLOADS]: The skill downloads an environment configuration template from the vendor's official repository.
Evidence: curl -o iblai.env https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/iblai.env.
[COMMAND_EXECUTION]: The skill executes various development and testing commands as part of its setup and verification process.
Evidence: Use of pnpm build, pnpm dev, pnpm test, and npx playwright screenshot for environment verification.

iblai-vibe-agent-tool