The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits running prototypes by capturing DOM structure, API traffic, and state transitions. This ingestion of untrusted data from potentially malicious or poorly-secured local applications presents a surface for indirect prompt injection.
Ingestion points: vibe-browser-audit.md (UI layouts) and runtime-observer-agent.md (API network logs/payloads) capture data directly from a running local server.
Boundary markers: Employs a 'Truth Precedence Hierarchy' and 'Truth Conflict Detector' to validate captured behavior against authoritative business requirements (REQS.md), preventing the model from blindly following logic found in the code.
Capability inventory: The skill uses Bash and Write tools to execute commands and create files based on its findings.
Sanitization: Implements a mandatory 'Regex-Scrubbing Pass' to remove absolute paths, hostnames, and secrets (API keys, tokens) from all captured traces before they are stored in the workspace.
[DYNAMIC_EXECUTION]: The skill generates and executes characterization test suites (e.g., Jest, Pytest) based on the recorded behavior of the prototype. This involves the dynamic creation and execution of scripts to ensure parity between the old and new versions of the code.
[COMMAND_EXECUTION]: Uses the Bash tool to perform system discovery, execute generated test suites, and register task states with an external control plane script.

reengineering-vibe-code