The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could theoretically harbor malicious instructions. 1. Ingestion points: User input captured during the interview procedure for PRODUCT.md via AskUserQuestion, and project-level files such as composer.json and lang/*.json. 2. Boundary markers: The skill implements an interview clarity threshold (80% clarity) and structured JSON parsing, though it lacks explicit delimiters for individual string interpolations. 3. Capability inventory: The agent is instructed to perform file writes (custom/, app/, lang/), execute shell commands (php forge, composer, npm), and install external skills. 4. Sanitization: The workflow includes PHP linting (php -l) and logic-based verification of project structure.
[DYNAMIC_EXECUTION]: The skill uses the php forge update command to generate or update runtime code and database schemas based on site-specific Model and Resource definitions. It also performs dynamic path resolution for layouts and component overrides.
[COMMAND_EXECUTION]: The skill executes various system-level commands to manage the project environment, including installation of dependencies (composer install, npm install) and local server management (php forge start, php forge update).
[EXTERNAL_DOWNLOADS]: The instructions recommend downloading and installing external resources, including the vendor design system (wonder-image/lib) and companion audit tools from GitHub repositories. These are standard dependencies for the site's development workflow.

wi-site