The Agent Skills Directory

[DYNAMIC_EXECUTION]: The provided audit script scripts/audit-make-ai-assistant-project.mjs uses dynamic imports to load and inspect the @qfei-design/make-ai-assistant package from the local filesystem of the project being audited. Evidence: The script uses import(pathToFileURL(resolvedAdapterPath).href) to verify the public exports and types of the installed package.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the integration of an AI assistant that processes external data from API responses and Server-Sent Events (SSE) streams, representing a potential indirect prompt injection surface. Ingestion points: Data is received via AuthenticatedTransport requests to /api/make/app/ai/v1/** and through AsyncIterable<Uint8Array> streams for response events. Boundary markers: The SKILL.md and references/make-app-host-integration.md files explicitly instruct developers to never execute server-provided HTML, JSX, CSS, or JavaScript. Capability inventory: The skill provides capabilities for file and image uploads, multi-session chat, and interaction with a dedicated Service gateway. Sanitization: The protocol documentation in references/make-app-protocol.md specifies that upstream errors must be sanitized into safe, schema-valid public error objects before being presented to the user.

make-ai-assistant