The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses shell commands to manage the application lifecycle, including creation, dependency installation, and verification.
Evidence: The workflow in SKILL.md uses pnpm, npx, python3, tmux, curl, and magick for project management and testing.
Evidence: The audit process is triggered via python3 "$SKILL_DIR/scripts/audit_app_project.py".
[DYNAMIC_EXECUTION]: The skill generates project structures, source code, and configuration files at runtime based on user briefs and then executes build/lint commands on this generated content.
Evidence: Step 4 in SKILL.md outlines implementation paths for new Web, Tauri, and macOS applications, including creating package.json and build configurations.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes local project files to determine its next steps, which could allow maliciously crafted files in a project to influence the agent's behavior.
Ingestion points: The scripts/audit_app_project.py script reads package.json, vite.config.ts, tauri.conf.json, Info.plist, and other source files from the target project directory.
Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are used when processing the results of the project audit.
Capability inventory: The skill has high capabilities, including writing to the filesystem, executing arbitrary shell commands through package managers, and performing local network operations.
Sanitization: While the audit script uses structured parsing (JSON and Regex) rather than raw text interpolation, it does not explicitly sanitize the project data against prompt injection before presenting the audit report to the agent.

lov-app-generator