The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/zoomies.mjs is a utility that spawns subprocesses using child_process.spawn. It accepts arbitrary commands and arguments from the command line and executes them while inheriting the full process environment (process.env), which can include sensitive environment variables.
[EXTERNAL_DOWNLOADS]: The skill workflow involves downloading and executing the codex-pet-companion package from the NPM registry via pnpm and npx. The documentation also instructs users to include a script from the unpkg.com CDN for static HTML deployments.
[PROMPT_INJECTION]: The skill processes user-provided or project-local pet.json files, which constitutes an indirect prompt injection surface.
Ingestion points: The SKILL.md instructions guide the agent to locate, read, and validate pet.json files.
Boundary markers: The skill lacks explicit boundary markers or system instructions to prevent the agent from following potential instructions embedded within the configuration files.
Capability inventory: The agent can execute shell commands through the zoomies.mjs wrapper, perform package installations, and write files to the public assets directory.
Sanitization: The skill delegates the responsibility of file validation to the external codex-pet-companion CLI tool rather than performing internal sanitization.

codex-pet-web