The Agent Skills Directory

[SAFE]: The skill provides a project bootstrapping utility and extensive architectural documentation for building SaaS applications. Analysis of the Python generation script and markdown instructions confirms that the tool operates as intended without hidden malicious code or exfiltration patterns.
[INDIRECT_PROMPT_INJECTION]: The project_bootstrapper.py script processes configuration data from an external JSON file to populate project templates. This creates a potential surface for template injection if the input is malicious. However, this is the intended functionality of a project generator and the risk is considered negligible in this context.
Ingestion points: The script reads from a user-provided config.json file in scripts/project_bootstrapper.py to determine project metadata and feature toggles.
Boundary markers: No explicit delimiters are used in the code templates, but the output is restricted to local file generation rather than direct execution.
Capability inventory: The script performs local file system operations (creating directories and writing text files) using standard Python libraries. It does not possess network or system-level execution capabilities.
Sanitization: The script uses json.dumps() for generating configuration files (e.g., package.json), providing robust escaping. Other templates rely on standard string interpolation, which is acceptable for developer-focused local tools.
[CREDENTIALS_SAFE]: All credentials mentioned in the code templates and instructions use placeholders (e.g., sk_test_..., pk_test_..., DATABASE_URL=postgresql://user:pass...) and recommend the use of .env files, which is a standard security best practice.

saas-scaffolder