The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes natural language prompts to perform shell operations (deployment, build, environment configuration), which is an inherent vulnerability surface for indirect instructions.
Ingestion points: Deployment and configuration prompts defined in SKILL.md (Steps 1, 3, and 4).
Boundary markers: Absent.
Capability inventory: Includes file access (Read, Write, Edit) and shell command execution (Bash for npm, npx, git, vercel, netlify, docker, etc.).
Sanitization: Not explicitly implemented within the skill logic.
[EXTERNAL_DOWNLOADS]: The skill installs and uses deployment tools from well-known services.
Evidence: npm i -g vercel, npx netlify deploy, and npx vercel --yes.
[COMMAND_EXECUTION]: Executes standard build, test, and deployment commands within the terminal.
Evidence: npm run build, npm test, git status, and gh pr comment for GitHub workflow integration.
[CREDENTIALS_SAFE]: Promotes secure handling of secrets by referencing environment variables and platform-specific secret management rather than hardcoding credentials.
Evidence: Uses $NETLIFY_SITE_ID, ${{ secrets.NETLIFY_TOKEN }}, and vercel env add for configuration.

windsurf-deploy-integration