The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides instructions for the agent to programmatically access sensitive credentials stored on the user's system. Specifically, references/flow/07-build-publish.md guides the agent to read OAuth access tokens from the macOS Keychain using the security find-generic-password command and from local configuration files located at ~/.local/share/opencode/mcp-auth.json.
[DATA_EXFILTRATION]: The skill reads the extracted OAuth tokens and sends them to a remote service endpoint (assetsUpdate service) as part of the component publishing workflow. While the destination is the vendor's infrastructure, the automated extraction and transmission of session tokens is a critical data access pattern.
[PROMPT_INJECTION]: The SKILL.md file contains a 'SILENT OPERATION' directive that explicitly forbids the agent from providing unsolicited prompts, permission asks, or confirmations between steps. By instructing the agent to 'never insert confirmations' or 'Allow?' dialogs, the skill attempts to override standard agent transparency and safety guardrails during sensitive operations.
[DYNAMIC_EXECUTION]: The skill employs dynamic execution techniques. It includes a shim (assets/dxcb-scaffold/lp-proxy-preload.mjs) that patches the Node.js https.Agent at runtime to modify how network requests are handled. It also uses node -e shell commands to execute dynamically generated JavaScript for bundling and zipping components.
[COMMAND_EXECUTION]: The skill executes various shell commands to manage the development environment, including npm install, npx tsc --noEmit, security for keychain access, and platform-specific commands like open, xdg-open, and start to manipulate the user's browser.
[EXTERNAL_DOWNLOADS]: The skill instructions involve downloading code and dependencies from external sources. It performs npm install to fetch the @pega/custom-dx-components package and is designed to fetch live component code directly from the pegasystems/constellation-ui-gallery repository on GitHub.

launchpad-ux-custom-builder