The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of agents that ingest 'free-form' input from sources like CLI arguments or Slack messages. These agents are granted capabilities to send emails, write to app databases (app_data_write), and execute code in a sandbox. This combination creates a significant surface for indirect prompt injection where malicious input could influence agent actions.
Ingestion points: Input is received via CLI flags (--input), input files, or Slack mentions (SKILL.md).
Boundary markers: The skill relies on the system prompt to define the contract, but does not enforce specific sanitization or delimiter requirements for external input.
Capability inventory: Agents can access saved_queries, connectors, email, app_data_write, and an ephemeral code sandbox.
Sanitization: Documentation notes that the backend validates manifest tools and limits, but does not describe input content filtering.
[DYNAMIC_EXECUTION]: The skill describes a core capability where managed agents run within a per-run code sandbox that allows them to 'write and run code' for tasks such as parsing data and generating documents (SKILL.md).
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a global NPM package (railcode) and download examples from a GitHub archive (Railcode-HQ/railcode-examples). These resources are owned by the vendor ('railcode-hq').
[COMMAND_EXECUTION]: The instructions include numerous commands for the railcode CLI to create, test, and manage agents, as well as npm and npx commands for installation and skill management.
[DATA_EXFILTRATION]: The railcode agent-feedback command sends system metadata, including OS platform, CPU architecture, and Node version, to a backend service (PostHog). The skill provides explicit instructions to omit sensitive data from these reports.

create-railcode-agent