The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes validation scripts (scripts/validate.sh and scripts/validate.ts) that execute standard development tools such as pnpm, tsc, biome, vitest, and dependency-cruiser to verify the codebase. These are legitimate operations for a development-focused skill.
[INDIRECT_PROMPT_INJECTION]: The validation scripts process the project's package.json and source code to determine which checks to run and to perform static analysis.
Ingestion points: Reads package.json in the user-provided application directory to check for scripts; analyzes source code in the src/ directory.
Boundary markers: Not explicitly defined for tool outputs, but the script logic uses hardcoded command names rather than dynamically executing content from the processed files.
Capability inventory: Command execution via spawnSync (TypeScript) and shell (Bash) to run linting, testing, and type-checking tools.
Sanitization: The TypeScript validator uses JSON.parse for safe reading of project metadata and implements specific quoting for PowerShell arguments to prevent command injection during Windows execution.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch relevant technical facts from docs.nestjs.com, which is an official and well-known service for the NestJS framework. This reference is documented neutrally as it targets a trusted source.

nestjs-feature