The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/production_audit.py utilizes the subprocess module to execute git status --porcelain. This is used as a read-only check to determine the state of the project's working directory during the production audit phase.
[INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection attack surface as it ingests and processes data from external project configuration files, including package.json, Cargo.toml, and tauri.conf.json in scripts/production_audit.py. Maliciously crafted metadata in these files could attempt to influence the agent's behavior during the build or installation steps.
Ingestion points: Data enters the agent's context through scripts/production_audit.py which reads project manifests and configuration files from the target repository.
Boundary markers: The skill instructions do not explicitly mandate the use of unique delimiters when interpolating project data into the LLM context, though it encourages the use of structured reports.
Capability inventory: The skill has access to the Bash tool, file system write capabilities (for implementation and local installation), and local command execution via Python scripts.
Sanitization: The scripts/profile_store.py utility includes a blacklist to prevent the persistence of secret-like fields (tokens, passwords, api keys). The audit script uses standard JSON and string parsing to extract values.

lov-dev-to-prod