The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone a repository from https://github.com/laskar-ksatria/building-observable-nodejs-api.git, which is a resource owned by the vendor.
[COMMAND_EXECUTION]: The instructions include shell commands for repository cloning, package installation via npm install, and cryptographic secret generation using Node.js or OpenSSL.
[INDIRECT_PROMPT_INJECTION]: The skill scaffolds a REST API that ingests untrusted user input via request bodies, queries, and parameters. This creates a potential surface for indirect prompt injection if the agent is subsequently asked to process data retrieved from the resulting backend.
Ingestion points: Untrusted data enters the system through req.body, req.query, and req.params as processed in the security middleware file.
Boundary markers: No delimiters or instructions are provided to prevent the agent from obeying potentially malicious instructions embedded in the processed data.
Capability inventory: The agent has the capability to perform shell operations for repository setup and environment configuration.
Sanitization: The template implements a security middleware that uses regular expressions to filter NoSQL injection patterns and HTML tags from incoming requests.

nodejs-express-mongodb-backend-pattern