The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for environment discovery, including ls on multiple directory paths to identify companion skills, and various supaguard CLI commands.
[DATA_EXFILTRATION]: The skill analyzes the user's source code, identifying sensitive structures like authentication forms and API endpoints, and reads .env files to find production URLs. The generated scripts are then uploaded to the vendor's cloud platform during the deployment process.
[REMOTE_CODE_EXECUTION]: The skill generates Playwright scripts at runtime and executes them through the supaguard checks test command, which constitutes the execution of dynamically created code derived from the local environment.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of a global NPM package (supaguard) as a prerequisite for its core functionality.
[PROMPT_INJECTION]: The skill includes a specific instruction to automatically perform a file system listing (ls) on skill directories when the skill is first activated in a conversation to recommend other skills.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the user's source code (Ingestion points: Workflow Step 1 in SKILL.md) and possesses execution capabilities (Capability inventory: CLI execution, file writing in SKILL.md) without documented boundary markers or sanitization logic.

supaguard