The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx tsx to execute a local utility script (scripts/scaffold.ts). This script is responsible for copying the project template and performing string substitutions. This is a standard and safe operation for a scaffolding tool.
[CREDENTIALS_UNSAFE]: The skill handles Alpaca API keys by reading them from environment variables or user input and writing them to a .env.local file in the generated project directory. The skill instructions explicitly forbid printing these secrets to the chat, and the generated file is standard practice for local development. It also provides a safe mode using placeholder values.
[EXTERNAL_DOWNLOADS]: The generated project depends on the official @alpacahq/alpaca-trade-api library and other well-known packages from the npm registry. These are appropriate for the skill's stated purpose and originate from the skill's own vendor.
[DATA_EXFILTRATION]: No patterns indicative of data exfiltration were found. The skill operates locally to create files and does not include instructions to send sensitive data to external servers.

starter-dashboard