The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a specific Node.js command: node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js cache compose --root <repository-root> --json. This command executes a script file located at a relative path that escapes the skill's directory structure.
[COMMAND_EXECUTION]: The agent is instructed to perform maintenance tasks using global command-line tools, specifically forge doctor and forge update all, which grants the skill the ability to trigger broader system-level operations.
[REMOTE_CODE_EXECUTION]: The instruction to run a Node.js script from the path ../../../.fullstack-forge/runtime/cli/src/composition-entry.js represents dynamic execution of code found in the host repository. This creates a risk where a malicious repository could provide a modified script to be executed by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a pointer that instructs the agent to ingest and follow instructions from ../../../.fullstack-forge/skills/forge-cache/SKILL.md and .forge/composition.json.
Ingestion points: Files located at relative paths ../../../.fullstack-forge/skills/forge-cache/SKILL.md and .forge/composition.json are added to the agent's context.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded malicious prompts within these files.
Capability inventory: The skill has the capability to execute shell commands (node, forge).
Sanitization: No evidence of path validation or command argument sanitization is present in the adapter instructions.

forge-cache