The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The file serving example in server/api/files/[name].ts demonstrates a path traversal vulnerability surface.
Ingestion points: The name parameter is retrieved directly from the router via getRouterParam(event, "name").
Boundary markers: None present to distinguish user input from the filesystem path.
Capability inventory: The script uses Bun.file() to read files and .text() to return their content to the client.
Sanitization: Absent. The route parameter is concatenated directly into the path ./data/${name}, allowing a malicious actor to use ../ sequences to read sensitive files (e.g., .env, package.json) outside the target directory.
[EXTERNAL_DOWNLOADS]: The quick start guide utilizes bunx nuxi@latest init to scaffold new projects.
Downloads project templates and execution logic from the official Nuxt CLI tool.
The skill proactively includes a "Secure Installation" section advising the user to block post-install scripts and use auditing tools like Socket to mitigate supply chain risks.

bun-nuxt