The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell commands for local development workflows, such as port management using lsof and kill (e.g., kill $(lsof -t -i :3000)) and project scaffolding with npm init.
[EXTERNAL_DOWNLOADS]: The instructions reference downloading and executing packages from the official NPM registry, specifically express for API scaffolding and @redocly/cli via npx for OpenAPI specification validation. These are standard developer operations targeting well-known services.
[DATA_EXPOSURE]: Provides a utility snippet for locally decoding JWT tokens using standard shell tools (base64, cut, jq). This is a common debugging practice and does not involve transmitting sensitive data to external servers.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it ingests untrusted data from API responses via curl and processes it using jq and other scripts. It possesses capabilities like file writing and command execution. However, no specific malicious injection instructions were found, and the behavior is consistent with the skill's primary purpose.

api-dev