The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to use the Bash tool for project initialization, running local development servers, and managing database migrations (e.g., npx prisma db push, uvicorn app.main:app, flutter run).
[EXTERNAL_DOWNLOADS]: The skill templates instruct the agent to download and install standard libraries and frameworks from official package registries (e.g., npm install prisma, pip install fastapi, flutter pub get). These references target widely recognized and trusted development tools.
[REMOTE_CODE_EXECUTION]: The skill utilizes remote initializers that download and run code from registries to scaffold new projects (e.g., npx create-next-app, npx nuxi@latest init, npm create astro@latest).
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by transforming natural language user requests into application code and architecture. 1. Ingestion points: Natural language prompts from users that define feature sets and application logic (e.g., SKILL.md). 2. Boundary markers: The orchestration involves a mandatory PLAN.md file for task tracking, but does not provide explicit instructions to delimit user input or ignore instructions contained within it. 3. Capability inventory: The skill has high access to the environment via Bash, Write, and Edit tools, and coordinates multiple specialized agents. 4. Sanitization: No explicit instructions are provided for sanitizing or escaping user-provided text before it is used to generate source code or configuration.

app-builder