The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute generated prototypes and interact with the local development environment. It identifies project task runners (such as Makefile, npm, or cargo) to integrate with existing workflows. The skill follows security best practices by recommending that the agent provides commands for the user to run rather than executing servers or scripts autonomously.
[DYNAMIC_EXECUTION]: A fundamental purpose of the skill is to generate and run temporary code files (e.g., .prototype.js). It manages the risks of dynamic code generation through a strict 'dispose-by-default' policy, employing a mandatory per-file deletion confirmation process and using marked filenames to differentiate prototypes from production code.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where instructions could be influenced by external project data.
Ingestion points: The skill reads project-specific configuration files (like package.json or pyproject.toml) and accepts high-level user prompts to drive code generation.
Boundary markers: The skill implements a 'scope box' and header comments to define the boundaries of the prototype's logic, which helps prevent scope creep but does not technically sanitize inputs via delimiters.
Capability inventory: The agent is granted Write, Edit, and Bash capabilities to fulfill the skill's requirements.
Sanitization: The instructions do not specify automated escaping or sanitization of external project data before it is interpolated into the generated prototype source code.

prototypekit