The Agent Skills Directory

[PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection in the documentation templates used to create theme definitions and synchronization scripts. Maliciously crafted theme identifiers or metadata provided by a user could potentially influence generated code.
Ingestion points: The skill ingests untrusted data in the form of theme identifiers, names, and homepage URLs (e.g., <theme>, <Theme Name>, <theme-homepage>) provided during the theme addition process.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the provided code templates.
Capability inventory: The skill involves the creation of executable Node.js scripts (scripts/sync-<theme>.mjs) that perform file operations (writeFileSync) and are intended to be executed as part of the project's build pipeline (bun run build).
Sanitization: The provided templates do not suggest any sanitization, escaping, or validation of the external strings before they are interpolated into the source code.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands for linting, building, and testing the project.
Evidence: Commands such as uv run lintro chk, bun run build, and bun run test are used to verify changes and compile assets.
[EXTERNAL_DOWNLOADS]: The theme definition template references external CSS assets from a well-known service.
Evidence: The webFonts array in the theme definition template includes links to Google Fonts (fonts.googleapis.com).

turbo-add