The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/dev-serve.sh extracts the 'scripts.dev' value from a repository's package.json and executes it within a tmux session using tmux send-keys. This allows for arbitrary code execution if the skill is run against a repository containing a malicious 'package.json' file.
[PROMPT_INJECTION]: The skill is vulnerable to indirect injection via untrusted repository metadata and file system paths.
Ingestion points: The script reads the scripts.dev field from package.json and the repository's folder name (via basename).
Boundary markers: No boundary markers or 'ignore' instructions are used when interpolating these values into commands.
Capability inventory: The script possesses capabilities to execute arbitrary shell commands via tmux, modify local configuration files using sed, and interact with the Caddy web server's administrative API via curl.
Sanitization: The script performs no sanitization or escaping on the folder name or the 'package.json' content before using them in sed commands or shell execution strings. A maliciously named folder could potentially result in configuration injection or file corruption.
[DATA_EXFILTRATION]: The skill's core functionality involves exposing local ports to a network-facing domain via a Caddy reverse proxy. While this is the intended purpose, it may inadvertently expose sensitive local development services to the internet or local network if the DEV_SERVE_DOMAIN is not carefully managed.

dev-serve