The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a dedicated 'Trust boundary' section in SKILL.md that instructs the agent to treat all scanned source code, comments, and tool output as untrusted data. This is a best practice that prevents the agent from following malicious instructions found within the project files it processes.
[COMMAND_EXECUTION]: The skill executes a bundled script, scripts/beast-doctor.cjs, to provide project diagnostics. This script is designed for safety: it limits file reads to 4 MiB, does not import or execute the target code, and contains no network-related code.
[EXTERNAL_DOWNLOADS]: The skill uses bun create beast@latest and bunx beast for project scaffolding and compilation. These are legitimate, expected toolchain commands for the Beast framework provided by the author (phtn).
[INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted code for analysis, it provides a clear evidence chain for safety:
Ingestion points: Reads *.btsx, *.tsrx, *.tsx, and *.ts files via the doctor script.
Boundary markers: Explicitly instructs the agent to ignore instructions within target files in the 'Trust boundary' section.
Capability inventory: Capabilities are limited to shell command execution for build tools and file reading/writing within the project scope.
Sanitization: The diagnostic script performs static lexical analysis using regular expressions and never executes the content it reads.

beast