The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to resolve the plugin root path using dirname, install dependencies, and start a web server using npx vite.
[EXTERNAL_DOWNLOADS]: The skill uses pnpm to download and install Node.js dependencies required for the dashboard from the npm registry. It attempts to follow security best practices by using the --frozen-lockfile flag to ensure dependency integrity.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user-provided $ARGUMENTS and the contents of the knowledge-graph.json file, which are then used in command execution and visualization.
Ingestion points: Project path provided in $ARGUMENTS and the .understand-anything/knowledge-graph.json file in the project directory.
Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present.
Capability inventory: The skill has access to shell execution (Bash), package management (pnpm), and local server execution (npx vite).
Sanitization: There is no evidence of sanitization or validation for the input path or the JSON data content before it is processed.

understand-dashboard