The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external backend source code, API contracts, and database configurations. This creates a surface for indirect prompt injection where malicious content in analyzed files could influence the agent's behavior.
Ingestion points: The scripts scripts/api-scaffolder.js, scripts/database-migration-tool.js, and scripts/api-load-tester.js take a targetPath positional argument to locate external project files.
Boundary markers: No explicit delimiters or instructions to ignore embedded prompts are present in the scripts or skill instructions.
Capability inventory: The provided scripts perform file system existence checks and generated reports based on target directory analysis.
Sanitization: No sanitization or content validation is implemented for the data processed from the target paths.
[METADATA_POISONING]: The SKILL.md file contains misleading technical metadata. It instructs the user/agent to execute Python scripts (e.g., python scripts/api_scaffolder.py) using underscores in filenames, while the repository actually contains Node.js scripts (e.g., scripts/api-scaffolder.js) using hyphens. This discrepancy between documentation and implementation can cause execution failures and user confusion.

senior-backend