The Agent Skills Directory

[SAFE]: The skill follows secure coding practices for an AI agent skill. It relies on a predefined set of markdown-based templates for code generation rather than dynamically executing strings. All external references point to official vendor documentation or installation sources.
[INDIRECT_PROMPT_INJECTION]: The skill processes project-level data (entity structures, module dependencies, project summaries) to determine the shape of generated DTOs. This ingestion surface is a standard part of the skill's primary function and does not pose a high risk.
Ingestion points: Data enters the skill's context through tools such as get_project_summary, list_module_dependencies, and get_entity_details (found in SKILL.md).
Boundary markers: The skill explicitly instructs the agent to use only code from the provided examples/ directory and follow rigid generation rules, which acts as a structural boundary.
Capability inventory: The skill utilizes file writing and editing tools to output generated code into the user's project (referenced in Step 6 of SKILL.md).
Sanitization: The skill implements variable substitution logic and mandatory FQN (Fully Qualified Name) shortening, which ensures that external entity data is formatted correctly within the generated Java/Kotlin code rather than being executed directly.

dto-creator