The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various lim CLI commands to manage builds and emulator instances, such as lim gradle build, lim android create, and lim android sync.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the lim NPM package from the global registry to provide the necessary CLI tools.
[REMOTE_CODE_EXECUTION]: Remote code execution is a core feature, as the skill syncs local project files to a remote environment where the project's own Gradle wrapper is executed to build the application.
[DATA_EXFILTRATION]: Project source code and sensitive build assets, such as keystores and service account keys, are transmitted to the vendor's remote infrastructure. The skill provides instructions for handling signing passwords and Play Store publication credentials.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it reads and processes configuration files from the local project directory, such as app.json and build.gradle. Ingestion points: The agent reads application IDs and version codes from project files in the workspace. Boundary markers: No specific delimiters or safety instructions are used to distinguish project data from agent instructions. Capability inventory: The agent can execute shell commands, read/write local files, and interact with remote APIs. Sanitization: There is no evidence of sanitization for the data extracted from project files before it is used in logic or displayed to the user.

limrun-gradle