The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for project creation and dependency management, including rails new and bundle add. It also utilizes cat, ls, and grep to inspect existing project structures for auditing purposes.
[EXTERNAL_DOWNLOADS]: The skill provides links and references to official Ruby on Rails repositories and community-standard gems (e.g., Devise, Pundit, Sidekiq, Kamal) on GitHub and official domains. These sources are treated as well-known and are used for documentation and research during the discovery process.
[CREDENTIALS_UNSAFE]: To audit inherited codebases, the skill directs the agent to read sensitive project configuration files such as config/database.yml, which often contain database access credentials.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its interview process. 1. Ingestion points: User responses during the discovery interview (SKILL.md). 2. Boundary markers: User-supplied variables like project names are interpolated directly into shell commands without delimiters or boundary warnings. 3. Capability inventory: Shell command execution (rails new, bundle add) and file system read access. 4. Sanitization: No explicit validation or escaping logic is provided to handle potentially malicious strings provided by a user during the interview.

rails-project-discovery