The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation references installation commands for the Bun runtime.
Evidence: The command curl -fsSL https://bun.sh/install | bash appears in references/detailed-guide.md.
Context: This is a standard installation method for a well-known development tool from its official domain.
[INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to process external data, creating a potential surface for indirect injection.
Ingestion points: Data is ingested via fetch requests, formData processing, and generic "untrusted input" handling mentioned in SKILL.md and references/detailed-guide.md.
Boundary markers: The skill includes strong instructions to narrow types (preferring unknown over any), validate invariants at runtime boundaries, and use explicit check functions.
Capability inventory: The skill demonstrates capabilities for network requests (fetch), file writing (Bun.write), and shell command execution (npm run, pnpm exec).
Sanitization: Explicit instructions are provided to avoid injecting untrusted HTML/URLs without validation, to use parameterized data access, and to ensure data is encoded before use.

javascript-typescript