The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/scaffold.mjs executes local shell commands to detect project environment details.
Evidence: The script uses child_process.execSync to run git remote get-url origin and git symbolic-ref --short HEAD to determine the repository owner, name, and default branch.
[INDIRECT_PROMPT_INJECTION]: The skill ingests metadata from the local project environment and interpolates it into documentation templates, which creates a potential surface for indirect injection if project manifest files contain malicious content.
Ingestion points: The script scripts/scaffold.mjs reads the project name, description, and version from local package.json, requirements.txt, and other manifest files.
Boundary markers: None present; the templates use simple {{VARIABLE}} placeholders.
Capability inventory: The skill uses Write tool permissions to place files and Bash tool permissions for environment detection via execSync.
Sanitization: No explicit sanitization or escaping is performed on the extracted project metadata before it is rendered into the templates.

professional-repo-docs