The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and scripts utilize standard package runners (npx, bunx, pnpm dlx) to fetch and execute official packages from the vendor (@prisma/cli, create-prisma). These are legitimate dependencies for the deployment workflow.
[COMMAND_EXECUTION]: The scripts/verify-compute-surface.mjs utility script uses node:child_process to execute CLI help commands. This is used to dynamically determine the capabilities of the installed environment and is not used for arbitrary command execution.
[EXTERNAL_DOWNLOADS]: The scripts/smoke-deployed-app.mjs script uses the fetch API to perform HTTP requests against deployment URLs. This is a legitimate functional test tool used to verify that an application is reachable after deployment.
[PROMPT_INJECTION]: While static analysis flagged potential concealment patterns, a manual review confirms these are actually security instructions advising the agent to avoid leaking user secrets (like database URLs and service tokens) in its output, which is a defensive measure rather than an attack.

prisma-compute