The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to autonomously 'discover the command' from files such as Cargo bins, tauri, package.json scripts, or Makefiles, and then 'start the server' using those commands. This behavior enables the execution of arbitrary scripts defined within the repository.
[CREDENTIALS_UNSAFE]: Instructions require the agent to 'discover how the repo provides' authentication tokens, seeded test accounts, and environment variables, and then 'record it in project.md'. This leads to the collection and potentially insecure storage of sensitive development credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
Ingestion points: Reads instructions from a 'ledger' provided by other skills, the API specification, and various repository configuration files (package.json, Makefile, Cargo.toml).
Boundary markers: None identified; instructions are interpreted directly to formulate curl requests and shell commands.
Capability inventory: Includes arbitrary shell command execution, file system writes (project.md), and network operations via curl or http tools.
Sanitization: No explicit sanitization or validation of the discovered commands or spec-defined parameters is performed before execution.
[DATA_EXFILTRATION]: The skill uses network tools (curl, http) to interact with a 'live server'. If the API specification or the 'discovered' run commands are manipulated, these tools could be used to transmit sensitive data to external endpoints.

validate-api