The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes entity structures defined by the user (Step 1) which are then used to generate executable code.
Ingestion points: The feature name and fields JSON array provided in Step 1 and Step 2 in SKILL.md are processed by the generator script.
Boundary markers: None present. The skill does not include instructions to the agent to validate or escape inputs for the generator.
Capability inventory: The skill uses Write to create files and Bash to execute the generator script, TypeScript compiler (tsc), and Jest (npm test).
Sanitization: In scripts/generate_crud.py, the generate_table_fields, generate_create_fields, and other generation functions perform direct string interpolation of the name and default values from the input JSON into TypeScript template strings without validation or escaping. If malicious identifiers are provided, they would be injected into the generated source code.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform development tasks.
The agent is instructed to run python scripts/generate_crud.py to generate the module.
The agent is instructed to run npx tsc --noEmit and npm test on the resulting code. While these are standard development procedures, the execution of generated code that has not been sanitized represents a common vulnerability surface for code generation tools.

nestjs-drizzle-crud-generator