The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell script examples and TypeScript code that execute system commands.
scripts/setup.sh executes several commands including npm ci, docker compose up, and npm run db:migrate.
The getAffectedPackages function in SKILL.md uses execSync to run npx nx show projects.
The scaffoldService function in SKILL.md uses execSync to run cp -r.
[DYNAMIC_EXECUTION]: The TypeScript code snippets demonstrate dynamic command generation.
In getAffectedPackages, the base parameter is directly interpolated into a shell command: npx nx show projects --affected --base=${base} --json. This is a potential command injection vector if the base variable is sourced from untrusted input.
In scaffoldService, the opts.type parameter is used to construct a file path for a copy command: cp -r templates/${opts.type}/. ${serviceDir}/. Without sanitization, this could lead to path traversal or command injection.
[INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting data that could influence agent behavior.
Ingestion points: Environment variables (via .env and zod validation), git branch names (via the base parameter in getAffectedPackages), and service configuration metadata.
Boundary markers: None identified in the code snippets to distinguish instruction from data.
Capability inventory: Uses child_process.execSync and fs.writeFileSync across multiple snippets.
Sanitization: The examples do not demonstrate sanitization or escaping of the input variables before they are used in shell commands or file operations.
[CREDENTIALS_UNSAFE]: The skill contains hardcoded development credentials in configuration files.
docker-compose.dev.yml includes POSTGRES_USER: dev and POSTGRES_PASSWORD: dev.
docker-compose.dev.yml includes DATABASE_URL: postgres://dev:dev@db:5432/appdb and REDIS_URL: redis://cache:6379.
While these are intended for local development, they match patterns for hardcoded secrets.
[EXTERNAL_DOWNLOADS]: The skill references standard GitHub Actions (actions/checkout, actions/setup-node) and the Codecov action for CI workflows. It also uses Dev Container features from the official GitHub Container Registry.

developer-experience-patterns