The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of OpenAPI 3.1+ specifications, which serves as a potential vector for indirect prompt injection.
Ingestion points: User-provided OpenAPI documents (via file path, URL, or pasted text) as specified in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or boundary markers to isolate the untrusted spec data from the agent's instructions.
Capability inventory: The skill allows for file system modifications (writing views.py, urls.py, manage.py, etc.) and shell command execution (uv, poetry, pip for installation; manage.py runserver for execution).
Sanitization: No explicit sanitization or instruction-filtering for the ingested spec content is provided.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to bootstrap the development environment and run the generated application.
Evidence: SKILL.md contains instructions to use package managers like uv, poetry, and pip to install dependencies and commands to start the Django server (e.g., uv run python manage.py runserver).
[EXTERNAL_DOWNLOADS]: The skill references and downloads external project templates and libraries during the scaffolding process.
Evidence: The skill downloads django-modern-rest and its associated extras (pydantic, msgspec, jwt), as well as the wemake-django-template. These resources are maintained by the skill's author, wemake-services.

dmr-openapi-skeleton