The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to access and manage sensitive configuration files located at migrations/<project>/config/*.env, including keys such as WIX_AUTH_TOKEN and source platform credentials. While the skill includes explicit guardrails (e.g., forbidding whole-file reads, preventing printing secrets to the user, and reporting only status), the access to sensitive files is a inherent part of its operation.
[COMMAND_EXECUTION]: The skill directs the agent to execute local scripts from sibling adapter skills (e.g., rp-source-wordpress/scripts/) to perform data capture. These scripts are part of the migration toolkit and are executed locally within the project environment.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted external data, including source API documentation, exports, and local dump files, to synthesize discovery artifacts.
Ingestion points: Reads source API docs, exports, and local dump files from the source system (e.g., WordPress, Shopify).
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the ingested source data.
Capability inventory: Performs file writes (source-profile.md, source-schema.json) and executes capture scripts from adapter skills.
Sanitization: No explicit sanitization or filtering of external content is described prior to artifact synthesis.
[EXTERNAL_DOWNLOADS]: The skill provides documentation for the user to install and configure ngrok, a well-known tunneling service, to facilitate media import to Wix. The provided instructions use placeholders for user-supplied tokens and are for development environment preparation.

rp-discovery