The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones the source code repository from the author's official GitHub repository (github.com/QwenLM/qwen-code.git). This is a standard operation for building the application from source.
[COMMAND_EXECUTION]: The skill performs several command-line operations to prepare the environment and build the application, including git clone, npm install, and npx tauri build. These commands are executed within an isolated build directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied branding data (such as brandId, logo path, and appName) which is interpolated into configuration and source files.
Ingestion points: User inputs for brandId, logo, website, appName, and appId via the brand configuration.
Boundary markers: The brand-create.mjs script enforces regex validation for the brandId (^[a-z][a-z0-9-]*$) and verifies that the provided logo path exists and has a valid image extension.
Capability inventory: The skill can write to the local file system (writeFileSync, copyFileSync) and execute shell commands via spawnSync and npm.
Sanitization: The script performs manual HTML entity encoding for HTML templates and uses a combination of JSON.stringify and manual quote escaping for JavaScript string literals to prevent injection into the application's code.
[DYNAMIC_EXECUTION]: The skill generates a temporary brand.json file and executes a bundled Node.js script (brand-create.mjs) to dynamically patch the tauri.conf.json and bootstrap UI files based on user input. The script uses spawnSync with an argument array (rather than a shell string) to safely execute the Tauri CLI for icon generation, mitigating potential command injection from crafted file paths.

desktop-brand-builder