The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses the AskUserQuestion tool in SKILL.md (Step 2) to gather project requirements from the user, which are then used to direct the behavior of specialized build agents.
Ingestion points: Project requirements, theme presets, and optional package selections gathered via AskUserQuestion in SKILL.md.
Boundary markers: None identified in the instructions to separate user input from agent instructions.
Capability inventory: The build agents dispatched in Step 4 have capabilities to write files and execute shell commands (bun, git, gh, vercel, convex).
Sanitization: No explicit sanitization or validation of user-supplied strings is described before they are interpolated into project files or used in configuration.
[COMMAND_EXECUTION]: The skill utilizes several standard command-line interfaces to perform its primary purpose of project scaffolding and deployment.
Evidence: Instructions in SKILL.md and references/stack-defaults.md invoke bun, git, gh, vercel, and convex to initialize repositories, install dependencies, and provision infrastructure.
[EXTERNAL_DOWNLOADS]: The skill installs numerous third-party dependencies from public registries.
Evidence: The skill automates the installation of packages such as better-auth, convex, @tanstack/react-query, and others via the bun add command. These are standard packages used for the skill's stated purpose.

create-next-project