The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted input.\n
Ingestion points: The skill ingests untrusted data from the $ARGUMENTS variable in Step 1 and project-level configuration files like .fullstack-dev/config.json in Step 0.\n
Boundary markers: There are no delimiters or specific instructions to the agent to treat the content of the directive as data rather than instructions, nor are there warnings to ignore embedded instructions in the files being read for context.\n
Capability inventory: The skill possesses high-privilege capabilities including the Bash tool for shell command execution and the Edit and Write tools for direct file system modification.\n
Sanitization: The skill does not implement sanitization or validation of the directives before applying them to the codebase.\n- [COMMAND_EXECUTION]: The skill executes shell commands through the Bash tool to perform build and verification tasks.\n
In the verification phase (Step 4), the skill runs commands defined in .fullstack-dev/config.json or defaults to common build tools like npm or npx if no configuration is found.\n
The escalation protocol in reference/fix-flow.md (Section 6) also uses git checkout to revert changes, which involves shell command execution.

fix