The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python script (firetv_build.py) to execute shell commands via subprocess.run. These commands facilitate the use of Java-based build tools (Apktool and uber-apk-signer). The script incorporates regex validation for user-influenced parameters, such as the application slug and package name, to mitigate command injection risks.
[EXTERNAL_DOWNLOADS]: The skill fetches build tools (apktool and uber-apk-signer) from GitHub. It implements a robust security control by verifying the SHA-256 checksum of these files against hardcoded values before use. Additionally, it downloads standard Python libraries and browser binaries (Chromium via Playwright) into an isolated virtual environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided descriptions to generate application logic and interface code within an HTML template.
Ingestion points: User-provided app descriptions are processed in SKILL.md to define the app's features and UI.
Boundary markers: The skill does not use explicit boundary markers for the user content, relying on the agent to interpret the description into a predefined template structure.
Capability inventory: The skill can execute local shell commands (for building and testing), perform network downloads (for tools and dependencies), and write files to the workspace.
Sanitization: There is no explicit sanitization of the user input, but the skill requires a mandatory testing step (testar_interface.py) that uses Playwright to detect JavaScript errors or UI issues in the generated code before it is packaged into an APK.
[CREDENTIALS_UNSAFE]: The skill generates sensitive credentials (keystore passwords) during the build process. It correctly handles these by instructing the agent to save them to a local text file and providing explicit warnings against sharing or displaying these passwords in the communication channel (chat).

app-to-firetv