The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local TypeScript tool, references/spec-extract-lib.ts, which spawns the semantius CLI to retrieve module configuration. These subprocess calls use argument arrays rather than raw shell strings, which effectively mitigates command injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill generates markdown documentation by interpolating data retrieved from an external database (entity names, field descriptions, and business logic). This creates a potential surface where malicious content stored in the database could influence an LLM that subsequently processes the generated spec file.
Ingestion points: Module metadata, entity definitions, and field descriptions are read via loadLive in references/spec-extract-lib.ts.
Boundary markers: The extractor uses markdown headers, tables, and triple-backtick JSON blocks to separate data fields.
Capability inventory: The skill can write files to the local directory and execute the platform's CLI tool.
Sanitization: Complex logic blocks are serialized using JSON.stringify to ensure they are valid JSON, though plain-text descriptions are emitted as-is within the markdown structure.

semantius-optimizer