The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses system package managers (npm, pnpm, or yarn) to install external dependencies required for the authentication flow.
[EXTERNAL_DOWNLOADS]: The skill fetches the @nodeops-createos/integration-oauth package from a public registry. This package is identified as a vendor-specific resource related to the NodeOps ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill instructions create a vulnerability surface by interpolating user-provided input into generated source code without explicit sanitization requirements.
Ingestion points: The agent is instructed to ask the user for a redirect path (e.g., "/dashboard") in Step 5.
Boundary markers: There are no specified delimiters or instructions to treat the user input as untrusted data.
Capability inventory: The skill possesses the capability to write and modify executable TypeScript/JavaScript files (app/callback/page.tsx).
Sanitization: The skill lacks instructions to validate or escape the user-supplied string before it is placed into a code literal within the useCallbackHandler function call, which could theoretically be exploited for code injection if a malicious string is provided.

nodeops-auth