The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection due to its core design of generating code from external data.
Ingestion points: Untrusted data enters the agent context via brand.json, saas-context.json, and brand-guidelines.md.
Boundary markers: There are no explicit markers or instructions to sanitize or wrap the ingested content to prevent it from breaking out of string literals in the generated .tsx and .ts files.
Capability inventory: The skill is capable of writing files to the local filesystem (sites/<slug>/) and executing shell commands (bun install, bun run build).
Sanitization: No sanitization, escaping, or validation logic is specified for the external data before it is interpolated into components.
[COMMAND_EXECUTION]: The skill automatically executes shell commands bun install (or npm install) and bun run build on the newly generated code tree. In an adversarial scenario, if the source data files are maliciously crafted to inject executable code into the generated React components or configuration files, these commands would execute that malicious logic within the agent's environment.
[SAFE]: The skill correctly manages sensitive credentials by checking for environment variables (SUPABASE_URL, SUPABASE_ANON_KEY) rather than requesting hardcoded values or storing them in plain text.

saas-landing-builder