The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx to execute remote initialization scripts for create-next-app and shadcn initialization. This is standard behavior for modern web development but constitutes execution of remote code.
[COMMAND_EXECUTION]: The skill is designed to run multiple shell commands on the user's system, including npm install, npm run lint, npm run dev, and npm run build to manage the project setup and validation.
[INDIRECT_PROMPT_INJECTION]: The skill accepts untrusted user input (e.g., folder names, project names, and database entity definitions) and uses these values to construct shell commands and generate code files.
Ingestion points: SKILL.md Step 1 and 2 (user inputs for folder names, domain entities, and custom field definitions).
Boundary markers: None provided in the command interpolation logic.
Capability inventory: Execution of shell commands via npx and npm, and extensive file system write operations.
Sanitization: The instructions do not explicitly require the agent to sanitize or validate these user-provided strings before they are passed to the shell.
[EXTERNAL_DOWNLOADS]: The skill downloads project templates and numerous library dependencies from the official npm registry.

nextjs15-init