The Agent Skills Directory

[COMMAND_EXECUTION]: The skill repeatedly instructs the agent to use the nlx command (e.g., nlx vitest run) for executing tests. nlx is not a standard command-line executor for Node.js packages (such as npx or yarn). While this may be an internal alias or vendor-specific tool used by sablier-labs, using a non-standard command for execution introduces a risk of running unintended binaries or malicious packages if a command named nlx exists in the environment or is fetched from an untrusted registry.\n- [REMOTE_CODE_EXECUTION]: The use of nlx to execute the vitest package represents a potential remote code execution vector. If the execution environment attempts to resolve and install a package named nlx from a public registry that is not the intended tool, it could lead to the execution of arbitrary code.\n- [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection through the ingestion of user-controlled data into shell commands.\n
Ingestion points: User-provided test names, matching patterns, and file paths (referenced in SKILL.md and MONOREPO_TESTING.md) that are used as arguments for running tests.\n
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions to prevent the agent from obeying instructions embedded in the user-supplied strings.\n
Capability inventory: The skill facilitates shell command execution via the nlx vitest utility across all instruction files.\n
Sanitization: Absent. There is no guidance for the agent to sanitize, validate, or escape user-supplied strings before interpolating them into commands such as nlx vitest run -t \"[user_input]\".

vitest-v4