The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses the user-provided module name argument to generate file paths and template content. While this creates a potential surface for path traversal or code injection if the input is malicious, this is a common pattern for code generation tools.
Ingestion points: The $ARGUMENTS placeholder in SKILL.md receives the module name input.
Boundary markers: No specific delimiters or validation logic for the input are defined in the skill instructions.
Capability inventory: The skill's primary function is to assist in file creation and provide guidance for shell command execution.
Sanitization: The instructions do not specify any sanitization for the provided module name.
[COMMAND_EXECUTION]: The skill includes documentation for setting up a local testing environment using shell commands.
Evidence: Includes example commands for docker run to start a PostgreSQL container and pnpm test to execute the generated suites. These are intended for manual execution by the developer in a local environment.
[CREDENTIALS_UNSAFE]: The documentation contains a hardcoded PostgreSQL connection string for testing purposes.
Evidence: postgres://mx:mx@127.0.0.1:5433/mx_verify. This string uses generic test credentials and points to the local loopback address, which is standard practice for local development documentation and does not expose sensitive production data.

create-e2e-test