The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves scanning source code files (via scanRoutes) to extract API route definitions. This data is then interpolated directly into shell command templates. If the source files contain maliciously crafted route paths, parameter names, or sample data, the resulting shell commands could be compromised.
Evidence: The generate-curl.ts script uses route.path, p.name, and route.body directly in string templates to build cURL commands without robust shell sanitization.
[COMMAND_EXECUTION]: The skill generates shell commands and wrapper scripts by concatenating strings. The provided shell script template (api-commands.sh) includes a generic execution pattern that allows running arbitrary commands.
Evidence: The api-commands.sh script ends with if [ -n "$1" ]; then "$@"; fi, which executes the script's arguments as a shell command.
[DYNAMIC_EXECUTION]: The skill generates and writes executable content, such as shell scripts and Makefiles, to the local file system.
Evidence: The curl-gen.ts script uses fs.writeFileSync(options.output, content) to save the generated commands to a file path provided via CLI options.

curl-command-generator