The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Node.js utility at scripts/validate_capture.mjs to validate workspace data. The script performs schema and file existence checks on manifest files but does not execute arbitrary shell commands or perform network operations.
[SAFE]: The skill implements strict isolation between reference material and generated code, explicitly instructing the agent to treat external captures as 'evidence and art direction' and requiring the replacement of all branding, copy, and proprietary assets.
[SAFE]: The skill ingests external data (manifests and markdown content) to generate child task briefs, which creates a surface for indirect prompt injection. This risk is mitigated by structural validation and explicit prompt boundaries.
Ingestion points: manifest.json and content.md files from the user's workspace directory.
Boundary markers: Use of a 'Thread brief contract' and explicit instructions to preserve originality and ignore source interaction logic.
Capability inventory: Local script execution via node, task creation via Codex tools, and code generation/deployment via the Sites plugin.
Sanitization: Structural validation of the JSON manifest is performed by the validate_capture.mjs script.
[SAFE]: No network operations to non-whitelisted domains, credential exposures, or obfuscation techniques were detected.

build-daily-inspiration-sites