The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install external code via the command npx skills add wondelai/skills/<slug> --global. The source repository 'wondelai/skills' is not associated with the skill's official author (manish31-oss) and does not belong to a recognized trusted vendor.
[COMMAND_EXECUTION]: The skill contains a fallback rule that prompts the user to execute shell commands (npx) to add missing dependencies. While this requires user interaction, it facilitates the execution of external binaries and packages within the user's environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of local files. It reads state and previous decisions from docs/GROW-APP-PLAN.md and other artifacts to resume its journey, which can influence the agent's logic if those files contain embedded instructions.
Ingestion points: Reads docs/GROW-APP-PLAN.md, docs/PRODUCT.md, docs/METRICS.md, and other files in the docs/ folder (Operating Rules 1 and 7).
Boundary markers: Absent. The skill does not use delimiters or instructions to ignore potential commands embedded in the processed documentation.
Capability inventory: The skill has the ability to write to the local filesystem and provides commands for shell execution.
Sanitization: Absent. The agent summarizes the journey state directly from the read files without validation or filtering of the content.

grow-app