The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes variant or harness scripts using the host's existing toolchain or development server. While this involves running potentially arbitrary code, it is the primary purpose of the prototyping tool and is restricted to isolated, non-production paths.
[DYNAMIC_EXECUTION]: The skill generates executable artifacts (e.g., index.html, app.js) at runtime based on user prompts and then executes them to capture results. Safety is managed by ensuring these files are temporary and restricted to the .tigerkit/prototypes/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface as it ingests data from external sources like tickets and specifications.
Ingestion points: Processes untrusted input from tickets, design references, specifications, and external code files as defined in SKILL.md.
Boundary markers: Lacks formal delimiters for input data, though it enforces operational isolation by keeping artifacts in a dedicated hidden directory.
Capability inventory: The skill can perform filesystem writes and execute shell commands to run generated prototypes.
Sanitization: No specific sanitization or escaping of external content is defined in the instructions.
[DATA_EXPOSURE]: The skill records absolute filesystem paths in its test receipts, which may reveal directory structure information of the host environment to the agent's context.

tk-prototype