The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The helper scripts utilize standard package managers and tool runners to download and execute development dependencies. Examples include npx create-next-app, npm create vite, and flutter pub get. These operations target well-known, trusted registries (npm, PyPI, Flutter) and are fundamental to the skill's primary purpose of software development.
[DYNAMIC_EXECUTION]: The scripts/run-tests.sh script uses eval to execute test commands. The command string is constructed internally based on detected project frameworks (e.g., Jest, Vitest, Pytest) and arguments parsed from the CLI, minimizing the risk of arbitrary command injection. Additionally, scripts/optimize-bundle.sh uses node -e for runtime modification of configuration files (e.g., package.json, webpack.config.js), which is a localized operation within the development environment.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface as it is designed to ingest and process entire codebases, project documentation (.project-docs/), and development plans (.design/PLAN.md). To mitigate risks, the workflow explicitly instructs the agent to follow a strict planning-first approach, avoid unauthorized optimizations, and perform security checks including npm audit and vulnerability scanning for SQL injection and XSS.
[COMMAND_EXECUTION]: Several helper scripts execute shell commands to manage project lifecycles, such as scripts/build-mobile.sh and scripts/init-project.sh. These commands are standard for mobile and web development (e.g., xcodebuild, gradlew, pod install) and do not perform suspicious or hidden operations.

developer