The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes content from external, potentially untrusted sources (plugin metadata and native source code) to generate its output. \n
Ingestion points: Files like plugin.xml, package.json, input-contract.yaml, and native source files (.java, .swift, etc.) are read to derive build actions. \n
Boundary markers: The instructions do not define specific markers or delimiters to isolate untrusted data during processing. \n
Capability inventory: The agent reads project files, writes configuration files to the disk, and executes validation commands. \n
Sanitization: While the skill validates the JSON structure of its output, it does not explicitly sanitize the content extracted from source files against malicious instructions. \n- [COMMAND_EXECUTION]: The skill directs the agent to run python3 -m json.tool or jq to validate the syntax of generated JSON files. This is limited to validation purposes using well-known system utilities. \n- [DATA_EXFILTRATION]: The skill accesses project configuration files such as AndroidManifest.xml, Info.plist, and google-services.json to derive build actions. While these are necessary for the skill's primary purpose of native build configuration, they represent access to sensitive project data.

build-actions-generator