The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local maintenance script (compile-interview.mjs) via Node.js to initialize and update interview data. This script is an internal component of the skill and performs controlled file operations without allowing arbitrary command injection or shell access.
[DATA_EXPOSURE]: The skill processes business strategy and interview responses, storing them in a local JSON file (.brandfy/interview.json). Analysis of the source code confirms that no data is transmitted over the network, and the script does not access sensitive system paths or hardcoded credentials.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for reading context from local files such as MVP.md. While reading external data is a potential injection vector, the skill uses this information solely for data mapping into a fixed schema. The script employs HTML comment markers () to isolate generated content from user-authored text, providing clear boundaries.
[DYNAMIC_EXECUTION]: The skill's Node.js script relies on standard built-in modules (node:fs, node:path) for file management. It does not utilize eval(), exec(), or dynamic loading of untrusted code, ensuring that the execution environment remains predictable and secure.

brandfy-entrevista