The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface for indirect prompt injection through user-provided service names.
Ingestion points: The skill ingests a <service-name> placeholder from user requests which is then interpolated into filenames (e.g., ecosystems/<service-name>.cljs), ClojureScript source code ((ns <service-name> ...)), and shell commands.
Boundary markers: The instructions do not define delimiters or specific warnings to ignore embedded instructions within these identifiers.
Capability inventory: The agent is instructed to perform file writes to the ecosystems/ directory and execute shell commands using pnpm, shadow-cljs, and pm2 (defined in SKILL.md).
Sanitization: There is no mention of sanitizing or validating the <service-name> to prevent command injection or path traversal attacks.
[DYNAMIC_EXECUTION]: The skill follows a script generation and execution pattern.
Evidence: The workflow involves creating .cljs source files from templates and then invoking npx shadow-cljs release clobber to compile them into executable JavaScript (.clobber/index.cjs), which is subsequently executed by PM2. This runtime compilation of generated source code is an intended but powerful capability.
[COMMAND_EXECUTION]: The skill requires the agent to run several shell commands to build and manage services.
Evidence: The skill explicitly lists commands such as pnpm generate-ecosystem, npx shadow-cljs release clobber, and pm2 start ecosystem.config.cjs in the SKILL.md file.

create-pm2-ecosystem