The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a PowerShell script (scripts/xampp-setup.ps1) designed to configure the local XAMPP environment. It performs system-level modifications, such as editing configuration files (php.ini, httpd.conf) and managing local services (Apache and MySQL). These actions are consistent with the skill's primary purpose of environment setup.
[PROMPT_INJECTION]: The skill presents patterns for building web APIs that ingest untrusted data from external sources, which constitutes a surface for indirect prompt injection.
Ingestion points: PHP global variables ($_GET, $_POST) and raw input streams (php://input) are used to capture user data in SKILL.md and references/php-8-4-api-patterns-2026.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are included for the data processed by the example code.
Capability inventory: The ingested data influences database operations (read/write) through the RecipeController and UserRepository classes.
Sanitization: The risk is mitigated by the skill's strong emphasis on security best practices, such as the mandatory use of PDO prepared statements and htmlspecialchars for output sanitization.

php-development