The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes project-local scripts through the bun runtime (e.g., bun run test, bun run types:check, bun run lint:check). These operations are restricted to a predefined list of framework-level tasks and are performed within a multi-phase pipeline that includes human approval of the plan.
[INDIRECT_PROMPT_INJECTION]: The skill reads project configuration files such as kata-manifest.json and package.json to establish context for framework changes. While these files serve as external data inputs, the risk is mitigated by the skill's strict enforcement of path guardrails documented in references/kata-invariants.md, which explicitly forbid access to sensitive directories and credential files.
[DATA_EXFILTRATION]: Analysis confirmed the presence of explicit 'FORBIDDEN' path rules in the kata-invariants.md file (section 10.2), which prevents the AI from accessing or modifying .env files and other credential-bearing artifacts during its operations.
[SAFE]: The skill uses well-known development tools and follows an 'Orchestration & Session' doctrine that prioritizes state persistence and verification over autonomous execution. No malicious obfuscation, hidden remote code execution, or privilege escalation attempts were detected.

framework-development