The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute bundled Node.js scripts (build.mjs and validate.mjs) to process and verify the generated art files. This execution is scoped to the local environment and the skill's specific purpose.\n- [DYNAMIC_EXECUTION]: The validate.mjs script invokes node --check to perform syntax validation on the JavaScript code generated by the agent. This uses the host's Node.js runtime to parse the file for errors without executing the underlying script logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill generates code based on user-provided descriptions (ideas). While this introduces a potential injection surface, the skill includes a security-focused validation script (validate.mjs) that inspects the resulting code for malicious patterns, such as network activity, storage access, or the use of eval(), effectively sandboxing the output. The mandatory evidence chain is as follows: (1) Ingestion point: User idea input in SKILL.md; (2) Boundary markers: Extensive guidelines in concepts.md and rules.md; (3) Capability inventory: Writing .js files and executing build/validation scripts; (4) Sanitization: The validate.mjs script provides regex-based filtering to prevent unsafe code patterns.

hairline-create