The Agent Skills Directory

[SAFE]: The skill provides legitimate scaffolding and auditing functionality for frontend and desktop projects. The included script, scripts/audit_app_project.py, performs static analysis on local project files to verify compliance with technical and branding standards without executing untrusted code.
[COMMAND_EXECUTION]: The skill utilizes standard project management tools including pnpm, npx, and tmux to initialize projects, manage dependencies, and orchestrate development environments. These actions are aligned with the skill's primary purpose.
[DATA_EXFILTRATION]: A local connectivity check is performed using curl against the loopback address (127.0.0.1) to verify the state of the served application. No patterns of external data exfiltration to remote servers were identified.
[PROMPT_INJECTION]: The skill processes project source code and configuration files during the audit phase, which represents an indirect prompt injection surface.
Ingestion points: Local files such as package.json, vite.config.ts, and various .ts/.tsx source files are read by the audit_app_project.py script.
Boundary markers: The audit utility generates a report in Markdown or JSON format, providing a structured output that limits the risk of the agent misinterpreting data as instructions.
Capability inventory: The skill has access to the local file system for project scaffolding, shell command execution via tmux, and local network access.
Sanitization: The audit process relies on static analysis techniques such as string matching and regular expressions, avoiding the execution or dynamic interpretation of the analyzed content.

lovstudio-app-generator