The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructs the agent to verify and read sensitive platform credentials, including a platform token, from a local configuration file.
Evidence: Step 1 instructions requiring the agent to check the iblai.env file for PLATFORM, DOMAIN, and TOKEN variables.
[INDIRECT_PROMPT_INJECTION]: The skill provides a code implementation that ingests data from browser storage into the application context without sanitization, which could allow malicious data to influence the application or agent context if the storage is compromised.
Ingestion points: localStorage.getItem("userData") and localStorage.getItem("tenant") used in the Step 2 React component snippet in SKILL.md.
Boundary markers: Absent.
Capability inventory: The skill utilizes subprocess calls for build, test, and browser automation (pnpm build, pnpm test, pnpm dev, npx playwright screenshot) and file-writing via curl in SKILL.md.
Sanitization: Absent; the code uses basic null-coalescing fallbacks but lacks input sanitization or validation.
[EXTERNAL_DOWNLOADS]: The skill downloads environment templates and documentation from the vendor's GitHub repository.
Evidence: curl -o iblai.env https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/iblai.env in Step 1.
[COMMAND_EXECUTION]: Instructions include executing shell commands for package management, testing, and screenshots.
Evidence: pnpm build, pnpm test, pnpm dev, and npx playwright screenshot listed in Step 4 verification steps.

iblai-vibe-billing