The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection through the ingestion of external business data.
Ingestion points: Data enters the system from external CSV files and WordPress REST API responses via resources/rp-source-csv/scripts/csv-discovery.js and resources/rp-source-wordpress/scripts/wp-discovery.js.
Boundary markers: The skill instructions do not specify any delimiters or safety warnings for the model to ignore natural language instructions embedded within the source data fields.
Capability inventory: The skill possesses write capabilities for site management, including installing apps and creating members via resources/rp-target-wix/lib/wix-writers.js.
Sanitization: Normalization logic in resources/rp-target-wix/lib/wix-build.js is focused on data structure and types rather than sanitizing natural language for injection patterns.
[COMMAND_EXECUTION]: The skill executes authorized vendor tools to manage authentication and preflight checks.
Evidence: resources/rp-execute-setup/scripts/mint-token.sh and lib/orchestration-preflight.js use npx @wix/cli@latest to acquire access tokens and verify the operator's identity.
[EXTERNAL_DOWNLOADS]: The skill performs necessary network operations to source and destination infrastructure.
Evidence: It makes HTTP requests to fetch records from source sites (WordPress, Shopify) and sends summarized performance telemetry to the author's official data sink (frog.wix.com).
[DATA_EXFILTRATION]: The skill captures and transmits summarized operational metadata.
Evidence: Telemetry sent to https://frog.wix.com/migration-data-validator includes summaries of Claude Code session transcripts from ~/.claude/projects/, which is used for service diagnostic purposes as disclosed in the README.

wix-replatform