The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively employs shell commands via the allowed Bash tool to manage project files, execute build systems, and control connected devices.
Evidence: Instructions include using grep to scan source code, git for version control management, and build utilities like gradlew and npm to update project dependencies.
Evidence: The skill calls the metavr utility to perform actions on VR hardware, such as app install, app launch, and perf capture.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the local environment and external sources, which could be exploited via indirect prompt injection.
Ingestion points: The agent is instructed to read project-specific configuration files (manifest.json, package.json, build.gradle, .uplugin), perform text searches on application source code via grep, and process documentation search results from the metavr docs search command.
Boundary markers: The skill does not provide the agent with specific boundary markers or instructions to isolate external data from its own command logic.
Capability inventory: The skill has access to the filesystem through Bash, build tools, and connected VR devices via the metavr tool, allowing it to act on instructions derived from processed data.
Sanitization: There is no evidence of data sanitization or validation for the project configuration or code snippets processed by the skill before they are used to inform subsequent agent actions.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and update of external software components from vendor-managed repositories.
Evidence: The instructions use npm update and npm install for Meta-associated packages such as @meta-spatial-sdk/* and @iwsdk/*.
Evidence: The skill uses npx -y metavr to dynamically fetch and execute the metavr CLI tool, introducing a dependency on external package registries at runtime.

hz-api-upgrade