The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax in SKILL.md to execute shell commands when the skill is loaded to provide runtime context.
Evidence: !npx @kopai/cli dashboards schema 2>/dev/null || ... in SKILL.md.
Evidence: !npx @kopai/cli metrics discover --json 2>/dev/null || ... in SKILL.md.
These commands are used to fetch the latest component schemas and available metrics directly from the vendor's backend tools.
[DYNAMIC_EXECUTION]: The skill instructs the agent to generate TypeScript code and execute it using a runtime runner.
Evidence: SKILL.md recommends "Code mode" where the agent creates a .mts file and runs it with npx tsx dashboard.mts.
Evidence: rules/workflow.md provides a detailed template for generating this code, which includes building queries and interacting with the @kopai/sdk.
[INDIRECT_PROMPT_INJECTION]: The skill processes telemetry data (metric names, types, descriptions) that could contain malicious instructions designed to influence the generated code.
Ingestion points: Metric metadata is fetched via client.discoverMetrics() in SKILL.md and rules/workflow.md.
Boundary markers: No specific delimiters or warnings are provided to help the agent distinguish between telemetry data and its own instructions.
Capability inventory: The agent has file-writing capabilities and command execution access via npx tsx and the vendor CLI.
Sanitization: The skill lacks instructions for sanitizing or escaping the metric metadata before it is interpolated into the generated TypeScript scripts.
[COMMAND_EXECUTION]: The skill workflow involves executing several CLI commands to manage the dashboard lifecycle.
Evidence: Mentions using npx @kopai/cli dashboards create, npx @kopai/app start, and npx tsx for script execution.
[EXTERNAL_DOWNLOADS]: The skill references and triggers the installation of several Node.js packages.
Evidence: References @kopai/sdk, @kopai/cli, @kopai/app, and the tsx utility in SKILL.md.

create-dashboard