The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user arguments to generate build pipelines and task configurations, creating a potential surface for indirect prompt injection. * Ingestion points: User requests are processed via the $ARGUMENTS parameter in command/turborepo.md. * Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within user inputs. * Capability inventory: The skill generates and modifies package.json scripts and turbo.json task definitions, which are executed as shell commands by the build system. * Sanitization: There are no explicit instructions for sanitizing or validating user-provided strings before interpolation into executable scripts.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references various ecosystem tools and GitHub Actions for CI/CD setup. * Evidence: Mentions npx syncpack, npx sherif, and npx @manypkg/cli for dependency management. * Evidence: Includes references to actions/checkout, actions/setup-node, and pnpm/action-setup in CI workflow templates. * These references target well-known and trusted organizations, adhering to standard development workflows.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill provides guidance on managing sensitive environment variables and tokens for remote caching. * Evidence: Documentation for setting up TURBO_TOKEN and GITHUB_TOKEN in CI environments is included. * The skill correctly recommends using secure storage methods like GitHub Secrets and Vercel Environment Variables rather than hardcoding credentials.

turborepo