The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains default credentials and configuration passwords intended for initial setup and documentation purposes.
Evidence: Default application account admin / 123456 and database password 123456 are provided in the Docker deployment example and project initialization instructions.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation and modification of modules by reading from the youlai-laravel repository, which establishes an attack surface for indirect prompt injection if source files are maliciously modified.
Ingestion points: The agent is instructed to read existing source code, database scripts (youlai_admin.sql), and repository structures to implement new features.
Boundary markers: The skill lacks explicit instructions for the agent to use delimiters or sanitization when interpreting content from the project files as data versus instructions.
Capability inventory: The agent is empowered to perform file system writes (generating PHP code), execute shell commands (php artisan), and configure network-facing services.
Sanitization: The skill mitigates risks by enforcing strict validation logic through Laravel Validate classes and standard PHP attributes.
[DYNAMIC_EXECUTION]: The skill utilizes a dynamic code generation pattern to scaffold new modules using stubs and templates.
Evidence: Use of .stub and .tpl files within the templates/ directory to automatically generate CRUD controllers, services, and models.

laravel