The Agent Skills Directory

[PROMPT_INJECTION]: No malicious patterns or attempts to override agent safety constraints were detected. The instructions are clearly scoped to Fusion Framework development and include explicit boundaries for what the skill should not be used for.
[DATA_EXPOSURE_AND_EXFILTRATION]: No evidence of hardcoded credentials, secrets, or unauthorized data transmission. The skill identifies that secrets should be managed via standard environment variables and provides guidance on secure token management using the framework's MSAL module.
[OBFUSCATION]: Analysis of the markdown instructions and reference files revealed no encoded content, hidden characters, or steganographic patterns.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: All referenced dependencies and package installations target official Equinor repositories or established industry packages (e.g., TanStack Query, styled-components). No untrusted remote script execution patterns (e.g., curl|bash) were found.
[INDIRECT_PROMPT_INJECTION]: The skill inherently interacts with project files like package.json and source code, creating a potential surface for indirect prompt injection. However, this is mitigated by structured planning and review processes.
Ingestion points: Analysis of package.json, tsconfig.json, app.config.ts, and src/ directory in Step 1 of the main instructions.
Boundary markers: The skill provides a detailed assets/review-checklist.md as a manual boundary for verifying generated code.
Capability inventory: The skill modifies files in the src/ directory and guides the execution of standard development commands like typecheck and lint via the package manager.
Sanitization: Not explicitly present for file reading, but findings are subject to human review via the post-generation checklist.
[DYNAMIC_EXECUTION]: No evidence of unsafe runtime code generation or execution from untrusted sources. All build and execution steps utilize established local tooling (Vite, TypeScript, CLI).

fusion-developer-app