The Agent Skills Directory

[METADATA_POISONING]: The YAML frontmatter in SKILL.md identifies 'Anthony Fu' as the author, which conflicts with the provided author context of 'christopher-buss'. This discrepancy appears to be a residual artifact from the template used to generate the skill.
[INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to ingest and act upon project-specific configuration files that could be manipulated to execute malicious instructions if the target repository is untrusted.
Ingestion points: Project files including package.json, pnpm-lock.yaml, .pnpmfile.cjs, .npmrc, and pnpm-workspace.yaml are identified as key configuration sources (referenced in SKILL.md and references/core-config.md).
Boundary markers: The instructions do not define specific delimiters or security warnings for the agent when reading potentially attacker-controlled content from these files.
Capability inventory: The agent is encouraged to use powerful commands such as pnpm install, pnpm run, pnpm exec, and pnpm dlx, which can execute arbitrary shell commands via lifecycle scripts or binaries (documented in references/core-cli.md).
Sanitization: While the skill documents configuration flags like ignore-scripts and onlyBuiltDependencies (in references/best-practices-performance.md), these are presented as optional optimizations rather than mandatory security controls for handling untrusted data.

pnpm