The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded keyPassword and storePassword fields are present in the build-profile.json5 configuration files within the test-cases/MVVMTestCaseV1/ and test-cases/MVVMTestCaseV2/ directories. These values are part of the standard HarmonyOS build configuration for local debug signing and do not represent production credentials.
[PROMPT_INJECTION]: The skill acts as an architecture assistant that reviews and refactors ArkUI code provided by the user. This ingestion of untrusted external content represents a surface for indirect prompt injection if the user-provided code contains instructions designed to bypass agent constraints.
Ingestion points: User-provided ArkTS and ArkUI code snippets intended for refactoring or architectural review.
Boundary markers: Not explicitly implemented in the skill instructions.
Capability inventory: The skill is designed to modify .ets files and utilize development tools for project building and static analysis.
Sanitization: No specific filtering or validation of user-provided logic is mentioned in the skill implementation.
[SAFE]: The skill references external image assets from picsum.photos for use as placeholders in the Article Detail page templates. This is a well-known service for development and UI prototyping.
[SAFE]: The use of HarmonyOS-specific decorators (e.g., @Observed, @Trace, @Param) and system APIs (e.g., AppStorageV2, PersistenceV2) for state management and resource handling adheres to official documentation and the primary purpose of the skill.

hmos-arkui-mvvm-pattern