The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because the scripts/scaffold_lingui_next.py script interpolates user-provided arguments (such as locales and package names) directly into generated source code and configuration files without sufficient escaping.\n
Ingestion points: Command-line parameters like --locales, --i18n-package-name, and --server-layouts-package in scripts/scaffold_lingui_next.py.\n
Boundary markers: None. Interpolated values are placed directly into template strings in files like data.ts.tpl and web/package.scripts.json.tpl.\n
Capability inventory: The skill writes and modifies files in the target project, including .ts, .tsx, .json, and .gitignore files using Path.write_text and json.dumps.\n
Sanitization: The script validates that the package manager is one of a few known strings (pnpm, npm, yarn, bun) but does not sanitize or escape other inputs for characters that could break code syntax or JSON structures.\n- [COMMAND_EXECUTION]: The skill generates scripts for the target project (e.g., web/scripts/build.ts and web/scripts/i18n/index.ts) that utilize execSync and spawnSync to run package manager commands and Lingui CLI tools. These are standard for the intended workflow but represent executable surface area generated from templates.

lingui-next-init