The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill utilizes a templating system in references/onboarding-guide.template.md that interpolates external project data into documentation and commands. 1. Ingestion points: Placeholders like {{INSTALL_COMMAND}}, {{REPO_URL}}, and {{PROJECT_NAME}} are filled with external data. 2. Boundary markers: No specific delimiters or safety warnings are present to prevent embedded instructions in the variable values from influencing the agent's behavior during generation. 3. Capability inventory: The skill generates executable content including shell scripts (setup.sh), Makefiles, and npm scripts. 4. Sanitization: No evidence of sanitization or validation of the interpolated data before it is written to files.
[PERSISTENCE]: The skill suggests modifying shell profile files to maintain development shortcuts. Evidence: Example 2 in SKILL.md explicitly suggests adding aliases to ~/.zshrc or ~/.bashrc (e.g., alias dev='npm run dev'). While intended for productivity, this involves persistent modification of the user's shell environment.
[COMMAND_EXECUTION]: The skill generates and encourages the use of scripts that perform system-level operations. Evidence: Example 1 in SKILL.md provides a setup.sh script that executes npm install, copies environment files, and runs database migrations. Example 2 provides a Makefile with rm -rf commands.

developer-experience