The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute shell commands using node and npm. Specifically, it uses node scripts/validate.mjs for DSL validation and npm run harness:build to compile the local package.
[DYNAMIC_EXECUTION]: The validation script scripts/validate.mjs uses a dynamic import() call to load the compiler library from a relative path (../../../dist/index.js). This allows the script to execute code from the project's build output at runtime.
[DATA_EXFILTRATION]: The script scripts/validate.mjs accepts a file path as a command-line argument and reads its entire content using readFile. While intended for DSL validation, this mechanism could be misused to read sensitive local files if the agent is provided with an arbitrary path.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of .harness files which are then parsed by a compiler.
Ingestion points: The scripts/validate.mjs file (line 33) reads the contents of a user-specified file path into the agent context.
Boundary markers: None identified; the file content is read directly into a string for compilation.
Capability inventory: The skill has the capability to read files from the filesystem and execute shell commands/npm scripts.
Sanitization: The skill relies on the compileHarness function from the @qoder-ai/harness package to parse and validate the input, but no explicit sanitization of the raw text is performed before parsing.

generate-harness-dsl