The Agent Skills Directory

[DYNAMIC_EXECUTION]: Several reference scripts utilize dynamic code execution patterns. The export_openapi.py script uses importlib.import_module to load FastAPI application instances from strings provided at runtime. Additionally, webmcp.mjs utilizes Playwright's page.evaluate() to inject and execute dynamically constructed JavaScript strings into a browser context to drive WebMCP tools.
[COMMAND_EXECUTION]: The skill manages several deployment and operational shell scripts. release-backend.sh and release-frontend.sh execute various system commands for packaging and deployment, including tar and docker compose. The api.mjs tool uses execFileSync to invoke the redocly CLI for bundling OpenAPI specifications.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest markdown templates and user-provided configuration to generate project rules and executable agent skills. While it employs versioning and metadata checks, the processed content directly influences the agent's future behavioral constraints.
[DATA_EXPOSURE]: The skill instructions and deployment templates frequently reference sensitive configuration patterns, including database credentials, JWT secrets, and API keys. While the skill correctly advises that real credentials should not be committed to repositories and should be managed via .env files or secret managers, it has the capability to read and process these sensitive files during operation.

doc-arch-rules