The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via curl to interact with the Supabase Storage API. It also uses the source command to load a shared helper script (supabase-api.sh) from a relative local directory.
[DYNAMIC_EXECUTION]: The skill dynamically assembles shell commands and JSON request bodies by interpolating variables like BUCKET_NAME, STORAGE_PATH, and FILE_PATH. This runtime assembly of executable content is a standard but noteworthy pattern.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to command injection due to the way it handles untrusted data.
Ingestion points: Variables such as BUCKET_NAME, FILE_PATH, and STORAGE_PATH are populated from the agent's context in SKILL.md.
Boundary markers: No delimiters or 'ignore' instructions are present to prevent malicious strings within the input from influencing the shell execution.
Capability inventory: The skill has the ability to execute network requests, read local files, and source external scripts.
Sanitization: The instructions do not specify any validation, escaping, or sanitization for user-provided variables before they are interpolated into shell commands.

supabase-storage