The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions and automation for installing several external dependencies from public registries. These include the Mastra framework (@mastra/core, @mastra/hono) and the Vercel AI SDK (@ai-sdk/openai). These are established, well-known services and do not represent a security risk when used as intended for development.
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for building AI agents that process untrusted data from web requests, which represents an attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through API endpoints defined in SKILL.md (e.g., /api/agents/{name}/generate) and assets/hono-server-template.ts (e.g., the /chat route).
Boundary markers: Delimiters or explicit instructions to ignore embedded commands are generally absent in the provided boilerplate code.
Capability inventory: Agents in this framework can execute tools (e.g., weatherTool in SKILL.md) and interact with file-system storage (e.g., LibSQLStore).
Sanitization: No explicit sanitization or filtering logic is provided in the templates, as it is expected to be implemented by the developer based on specific use cases.
[DYNAMIC_EXECUTION]: The skill includes several Deno scripts used for project and component scaffolding. These scripts generate source code files locally based on user-provided names and templates.
Evidence: scripts/scaffold-project.ts and scripts/scaffold-agent.ts use Deno.writeTextFile to programmatically create the project structure and initial logic.

mastra-hono