The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes subprocess.run in Python and execFile in Node.js to execute local utility scripts (such as tools/apexctl.mjs) and external system tools (sql, apex). These invocations use programmatically resolved paths within the repository or the system PATH and do not appear to incorporate unsanitized user input directly into shell commands.
[DYNAMIC_EXECUTION]: In runtime/grammar_contract.mjs, the skill uses dynamic import() to load local JavaScript modules for component metadata resolution. This follows local path resolution logic and is internal to the tool's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted user-supplied functional requirements and model metadata used to generate application artifacts. This potential vector is mitigated by a structured specification phase, a multi-agent review loop (Critique agent), and mandatory validation gates using the APEXlang compiler and live database checks.
[SAFE]: External references to GitHub-hosted resources (github.com/oracle/...) and documentation previews are directed toward well-known, trusted domains and official vendor repositories.

apexlang-generation