The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to orchestrate the build process, including git clone to retrieve source code, bun install to manage dependencies, and various build commands like electron:dist:mac to package the final application.
[EXTERNAL_DOWNLOADS]: The skill downloads the qwen-code project from the vendor's official GitHub repository (github.com/QwenLM/qwen-code.git) to serve as the base for the branded build.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided fields such as appName, appId, and copyright for use in code generation. These inputs are interpolated into the branding.ts file of the target project. While basic character escaping is implemented, this pattern creates a theoretical surface for injection if the inputs are not carefully reviewed.
Ingestion points: User-supplied branding configuration fields in brand.json (appName, appId, website, copyright).
Boundary markers: The script uses a helper function tsString to enclose the generated values in single quotes and escape existing single quotes and backslashes.
Capability inventory: The skill possesses the ability to perform file system writes and execute shell commands via Bun.spawn.
Sanitization: The brandId is strictly validated using a regular expression, and branding fields undergo basic character escaping before being written to the application's source code.
[DYNAMIC_EXECUTION]: The bundled build script uses createRequire to dynamically resolve and load the sharp image processing library from the project's local dependency directory. It also uses Bun.spawn to execute system-level icon generation utilities like iconutil and xcrun actool.

desktop-brand-builder