The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides and instructs the agent to execute two utility scripts: scripts/check-tina-versions.sh and scripts/check-tina-env.sh. These scripts perform read-only inspections of the project's package.json, lockfiles, and .env files to determine the development "lane" (TinaCloud vs. Self-hosted) and package versions. This is an intended diagnostic capability to route the agent to the correct documentation.
[DATA_EXPOSURE]: The script scripts/check-tina-env.sh scans local .env files for the presence of sensitive environment variable names (e.g., TINA_TOKEN, GITHUB_PERSONAL_ACCESS_TOKEN, CLERK_SECRET). The script is designed to verify the existence of these keys to confirm setup completion and does not extract or echo their secret values.
[INDIRECT_PROMPT_INJECTION]: As the skill involves the ingestion of MDX content and CMS data, it defines a surface for indirect prompt injection. However, the provided documentation consistently recommends security best practices, such as verifying webhook signatures, using structured data validation, and sanitizing user-provided HTML content via libraries like DOMPurify.

build-tinacms-nextjs