The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to manage local application development, which includes executing pnpm dev and running conformance tests. These operations are restricted to the generated application's root directory and are only initiated upon explicit user request for preview or debugging.
[INDIRECT_PROMPT_INJECTION]: As a tool that generates application code from user-defined requirements, it possesses a surface for indirect prompt injection. The skill mitigates this by providing extensive instructions for data validation, the use of busabase-sdk as a secure data boundary, and ensuring that no secrets are exposed to the browser or logs. The evidence chain includes ingestion via the Product Overlay in SKILL.md, boundaries defined by the Hono/AirApp architecture, capabilities like local file writes, and sanitization through resource mapping and identity bootstrap.
[SAFE]: The skill demonstrates high security awareness by mandating owner-only permissions (0700/0600) for its local credential store in ~/.busabase/airapps/ and delegating sensitive operations like secret management to the Busabase Vault system.

kelly-app-skill-creator