The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided input via the $ARGUMENTS variable and reads instructions from a local documentation file .guidelines/fields-development.md. This content is then used to guide the generation of PHP and Blade code. Maliciously crafted input or documentation could potentially influence the agent to generate insecure code or perform unintended actions.
Ingestion points: Processes $ARGUMENTS and reads .guidelines/fields-development.md.
Boundary markers: No specific delimiters or "ignore instructions" warnings are present in the prompt to separate user input from the system instructions.
Capability inventory: The skill uses Write, Edit, and Bash tools to create and modify files in the app/ and resources/ directories.
Sanitization: No explicit sanitization or validation of the input data is described before it is used in code generation.
[COMMAND_EXECUTION]: The skill uses the Bash tool to implement field logic and potentially manage the Laravel environment. While this is necessary for its function as a developer assistant, it provides a vector for executing commands if the prompt instructions are successfully subverted.

moonshine-field