The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones a project template from a remote repository at https://github.com/Eng0AI/magic-portfolio-template.git. This introduces external code from a source outside the verified ecosystem.
[COMMAND_EXECUTION]: The skill performs shell operations including git clone, npm install, and npm run build. Executing npm install on untrusted external code allows for potential remote code execution via pre-install or post-install scripts defined in the downloaded project's package.json.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where data from a remote source is processed with high-privilege capabilities.
Ingestion points: Clones an entire file structure from a third-party GitHub repository into the agent's working environment.
Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the cloned files.
Capability inventory: Subprocess execution (npm, git, vercel, netlify), file system modification (mv, rm, git init), and network operations for deployment.
Sanitization: Absent; the skill does not validate the integrity or safety of the downloaded project files before processing them.

magic-portfolio