The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to treat openapi.yaml as the primary source of truth for generating project structures, TypeScript types, and request handlers. This behavior creates a surface for indirect prompt injection where a maliciously crafted specification file could influence the agent's code generation or command execution logic.
Ingestion points: The agent reads and interprets the local openapi.yaml file to perform scaffolding and route updates (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters used to warn the agent to ignore potentially malicious content within the YAML specification.
Capability inventory: The skill possesses the ability to execute shell commands (pnpm, go run, tsx) and write various source files to the local file system.
Sanitization: The process lacks validation or sanitization steps to ensure the integrity of the specification content before it is used to generate executable code.
[REMOTE_CODE_EXECUTION]: The skill guides the user to download and execute code from remote sources using standard development tools.
Fetches and runs the OpenAPI generator CLI via pnpm dlx @openapitools/openapi-generator-cli.
Downloads and executes the Go SDK generator directly from its GitHub repository using go run github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen.
[EXTERNAL_DOWNLOADS]: The provided boilerplate configuration includes a standard set of dependencies and development tools from established registries.
The package.json template defines dependencies such as express, express-openapi-validator, and development utilities like vitest, biome, and typescript.
[COMMAND_EXECUTION]: The skill relies on shell commands for lifecycle management and code generation.
Uses pnpm generate to trigger the openapi-typescript tool.
Uses tsx to execute the generated backend server during development.

contract-first-backend