The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (e.g., email, messages) to generate notifications. It explicitly instructs developers to escape this content using Laravel's e() and nl2br() helpers to prevent XSS and HTML injection, demonstrating a positive security practice. Evidence: escape untrusted variable content before returning it because customized database content is rendered as HTML: return ['email' => e($data['email']), 'message' => nl2br(e($data['message']))]; (SKILL.md).
[COMMAND_EXECUTION]: The skill uses conditional logic to check for the presence of local directories (modules/NotificationPreview/Herald/) and forked versions of the skill before proceeding. This is used for workflow steering and does not involve executing arbitrary shell commands or external scripts.

notification-development