The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill determines its preview scope and launch approach by analyzing external, untrusted content from the codebase and PR descriptions. This ingestion of untrusted data could allow an attacker to influence the agent's actions during the setup process.
Ingestion points: The skill resolves preview scope from PR URLs, code diffs, README files, and application entry points (SKILL.md, Step 1).
Boundary markers: There are no explicit instructions or markers to differentiate between data to be processed and instructions to be ignored within the ingested content.
Capability inventory: The skill possesses significant capabilities, including arbitrary command execution via the Bash tool and process log monitoring via the Monitor tool.
Sanitization: The instructions do not define any sanitization or validation logic for the content read from external sources before it influences the setup flow.
[COMMAND_EXECUTION]: The skill is designed to execute project-specific build and startup commands using the Bash tool.
Evidence: Step 3 explicitly details the use of the Bash tool with run_in_background: true to stand up the stack and manage server processes.

preview