The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes user-controlled project files, such as package.json and the amplify/ directory, to determine development state and planning.
Ingestion points: SKILL.md reads package.json and the amplify/ directory to understand the project state.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the content of the ingested project files.
Capability inventory: The skill possesses extensive capabilities, including executing shell scripts, AWS CLI commands, and package manager (npm) operations.
Sanitization: The workflow does not specify any sanitization or validation logic for the data read from local project files before it influences the agent's decision-making process.
[REMOTE_CODE_EXECUTION]: The skill dynamically retrieves instructional "SOPs" (Standard Operating Procedures) from an external aws-mcp server. These fetched SOPs, such as amplify-backend-implementation and amplify-deployment-guide, provide the primary logic and code-generation instructions followed by the agent.
[COMMAND_EXECUTION]: The skill executes a bundled shell script scripts/prereq-check.sh to validate the local environment and invokes system tools including npm, aws, and various framework-specific development servers.
[DATA_EXFILTRATION]: The prerequisite check script executes aws sts get-caller-identity, which retrieves and exposes the user's AWS Account ID to the agent's processing context.

amplify-workflow