The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests a user-provided "idea" and "template" which are passed to a recipe to generate a project. This untrusted input influences the generated code and agent behavior.
Ingestion points: The workflow section in SKILL.md identifies the {idea, template} object as primary input for the initialization recipe.
Boundary markers: The instructions do not define specific delimiters or guardrails to prevent instructions embedded within the user's "idea" from overriding skill logic.
Capability inventory: The skill has the ability to write files to the local filesystem and execute shell commands via npx for verification.
Sanitization: No explicit validation or sanitization of the input strings is described before they are processed by the recipe.
[DYNAMIC_EXECUTION]: The skill generates backend code (Convex schemas and functions) and immediately attempts to execute and verify it as part of its "SELF-VERIFY RULE".
Evidence: SKILL.md instructs the agent to run npx tsc --noEmit and npx convex dev --once on the newly generated codebase to ensure it compiles and deploys.
[COMMAND_EXECUTION]: The skill uses shell commands to manage the development lifecycle.
Evidence: Use of npx convex dev and npx tsc in SKILL.md to perform local anonymous deployments and type checking.
[EXTERNAL_DOWNLOADS]: The skill workflow depends on fetching external components and tools.
Evidence: The quickstart-recipe@^2 is fetched and cached by the platform, and npx is used to invoke external tools (Convex and TypeScript). These represent standard external dependencies for the development environment.

convex-quickstart