The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides detailed instructions and workflows for executing the @ui5/cli toolchain. This includes initializing projects (ui5 init), managing dependencies (ui5 add, ui5 remove), running development servers (ui5 serve), and generating production builds (ui5 build). These are standard development operations for the SAPUI5/OpenUI5 ecosystem.
[PRIVILEGE_ESCALATION]: The documentation includes setup instructions that require administrative privileges for environment configuration. Examples include installing the hyperfine benchmarking tool via system package managers (sudo dpkg, sudo pacman) and trusting self-signed SSL certificates for local HTTPS development on macOS using sudo security add-trusted-cert. These are presented as explicit, legitimate administrative steps for a developer to perform.
[EXTERNAL_DOWNLOADS]: The skill references and provides instructions for installing official packages from well-known registries, such as @ui5/cli and related framework libraries via npm. It also mentions third-party development utilities like hyperfine for performance testing. All referenced sources are established industry tools or official SAP resources.
[DYNAMIC_EXECUTION]: The skill provides boilerplates for 'Custom Tasks' and 'Custom Middleware', which allow the UI5 Tooling to be extended with user-defined JavaScript logic. These extensions run within the Node.js environment and can perform file system operations (via the UI5 FileSystem API) and network request handling. The templates provide secure patterns, such as using async/await and handling Express middleware correctly.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to manage and modify local project files, there is a theoretical attack surface if an agent using this skill were to process a repository containing malicious instructions.
Ingestion points: The agent reads and analyzes project files such as manifest.json, ui5.yaml, and JavaScript source files from the project workspace.
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for data processed from the project files.
Capability inventory: The skill enables file writing (workspace.write) and shell command execution (ui5 build, ui5 serve) as part of its core functionality.
Sanitization: No specific sanitization of project file content is included, as the tool assumes the project source code is trusted for the purpose of building and serving.

sapui5-cli