The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a command-line interface using the commander package. It accepts user input for startup ideas and an optional output file path. All operations are local to the user's environment.
[DATA_EXPOSURE]: The application accesses the OPENAI_API_KEY environment variable to authenticate with OpenAI's API. This is a standard and safe practice for CLI tools requiring external API access.
[INDIRECT_PROMPT_INJECTION]: The tool interpolates user-provided startup descriptions directly into a prompt sent to the LLM (src/index.ts). While this creates a surface for prompt injection, the risk is negligible as the output is restricted to generated markdown text written to a local file and does not influence the agent's executable logic.
Ingestion points: The idea argument accepted in src/cli.ts and passed to the generatePitch function.
Boundary markers: None. The user input is concatenated into the prompt string.
Capability inventory: File writing (fs.writeFileSync in src/cli.ts) and network requests to OpenAI's API.
Sanitization: No specific sanitization or escaping of the user input is performed before interpolation.
[REMOTE_CODE_EXECUTION]: All dependencies are standard, well-known packages from the NPM registry. There are no patterns involving the execution of remote scripts or dynamically fetched code.

pitch-gen