The Agent Skills Directory

[COMMAND_EXECUTION]: The file scripts/create-openapi-spec.md utilizes the dynamic context injection syntax (!command) to execute shell operations like grep and date automatically when the script is processed by the agent. This includes searching for route definitions and environment variables.
[CREDENTIALS_UNSAFE]: The script scripts/create-openapi-spec.md is designed to extract values from .env* files using grep. While intended for discovering API base URLs, automated scanning of environment files is a sensitive operation that can inadvertently expose secrets or internal configuration details if they are present in the searched files.
[PROMPT_INJECTION]:
Ingestion points: The skill instructions and path_patterns configure the agent to read and analyze content from **/routes/**, **/api/**, and **/endpoints/**.
Boundary markers: The skill lacks explicit delimiters or instructions to the agent to disregard potentially malicious commands embedded in comments or strings within the ingested source code.
Capability inventory: The agent has access to powerful tools including WebFetch, WebSearch, and shell Grep through the allowed-tools configuration.
Sanitization: No sanitization or validation logic is defined to prevent instructions found in untrusted project files from influencing the agent's behavior.

api-design