The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Node.js helper script (scripts/webly.mjs) to execute deterministic deployment tasks. This includes running project build commands such as npm install and npm run build, as well as managing agent MCP registrations using the claude and codex CLIs. These actions are standard for the skill's primary purpose of hosting and deployment.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to api.webly.ai for site management, file uploads, and status checks. It also fetches version metadata from the vendor's official GitHub repository to check for updates. All external communication is directed to trusted vendor domains.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted local project files, creating a potential surface for indirect prompt injection.
Ingestion points: The webly.mjs script reads all files within a project directory (excluding .git and node_modules) for deployment.
Boundary markers: Instructions do not specify delimiters or safety warnings for the agent when processing the content of these files.
Capability inventory: The skill possesses capabilities for command execution (npm/yarn), file system writes (state and project configuration), and network uploads.
Sanitization: File content is transported as UTF-8 or Base64 without sanitization.
[SAFE]: The skill demonstrates secure credential handling by storing authentication tokens in ~/.webly/state.json with restricted filesystem permissions (0600) and providing explicit instructions to the agent to prevent token exposure. All resources are associated with the verified publisher 'webly-ai'.

webly