The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated scanners flagged the domain docs.purchasely.com as a malicious phishing site. The skill directs the agent to verify integration details at this URL. While this is the official vendor domain, users should be aware of the automated security alerts.
Evidence: SKILL.md contains multiple references to https://docs.purchasely.com/ for documentation.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where malicious instructions could be embedded in the project files the agent is instructed to read.
Ingestion points: The agent reads project files like build.gradle, package.json, pubspec.yaml, and config.xml to detect the platform.
Boundary markers: The instructions do not specify any delimiters or safety warnings to ignore instructions found within these ingested files.
Capability inventory: The skill allows the agent to write code directly to the project, run shell commands for package installation (npm, pod, flutter, cordova), and execute build commands (gradlew, xcodebuild).
Sanitization: There is no mention of sanitizing or validating the content read from the local project files before processing.
[COMMAND_EXECUTION]: The skill requires the agent to execute various package manager and build system commands. This is consistent with its primary purpose but represents a significant capability level.
Evidence: Commands include npm install, flutter pub add, cordova plugin add, pod install, and ./gradlew assembleDebug across the different platform integration steps.

purchasely-integrate