The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates an architecture where the agent writes and executes code via the execute_typescript tool. This creates a surface for indirect prompt injection if the model processes untrusted external data.
Ingestion points: The execute_typescript tool receives model-generated code as defined in SKILL.md.
Boundary markers: The instructions recommend using a short instructional note above declarations in a fenced typescript block to separate system instructions from tool definitions.
Capability inventory: Execution is limited to defined external_* tools and console functions within a QuickJS sandbox. The environment lacks fetch, require, and system timers by default.
Sanitization: The instructions emphasize performing rigorous type-checking and throwing on compiler diagnostics during the transpile phase before execution.
[DATA_EXFILTRATION]: Technical reference documentation indicates that the snippetToTool component logs inputs and code directly to server logs. This represents a data exposure risk if sensitive information is processed through these snippets.
Evidence: references/hidden-knowledge.md documentation regarding snippetToTool logging behavior: "console.logs inputs and code (data in server logs)".
[DYNAMIC_EXECUTION]: The skill describes a system for runtime transpilation and execution of code. It notes that the default transpiler only removes type annotations (stripping) and does not validate code safety or correctness, requiring developers to implement their own safety checks.
Evidence: Detailed breakdown of the execution flow, Sucrase limitations, and the JSON.parse/JSON.stringify boundary logic in references/hidden-knowledge.md.

tanstack-ai-code-mode