The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/validate.py contains a reference to the official Bun installation script at https://bun.sh/install. This URL is included in the validation report as a recommended fix for the user if the Bun runtime is not found in the environment.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute commands. In scripts/validate.py, it runs bun --version to check for the presence and version of the Bun runtime. In tests/test_validate.py, it executes the Python validation script itself as part of the test suite.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests data from untrusted local project files.
Ingestion points: The file scripts/validate.py reads several project files, including package.json, biome.json, biome.jsonc, next.config.ts, postcss.config.js, and various CSS files.
Boundary markers: There are no boundary markers or instructions used to prevent the agent from following potential instructions embedded within the processed configuration files.
Capability inventory: The skill's primary capabilities involve reading local files and executing version-related commands (bun --version).
Sanitization: The script parses configuration data using JSON loaders and regular expressions but does not specifically sanitize the input to prevent prompt injection attacks.

validate-stack