The Agent Skills Directory

[SAFE]: The skill functions as a legitimate project scaffolding tool, providing guidance and templates for building applications using industry-standard frameworks and coordination logic across specialist agents.
[EXTERNAL_DOWNLOADS]: The skill's templates include instructions to download and install well-known libraries and frameworks (e.g., Next.js, FastAPI, Prisma, Tailwind, Expo) from official registries such as npm and PyPI. These are considered safe and standard development dependencies.
[COMMAND_EXECUTION]: The skill instructs the agent to utilize shell commands via the Bash tool to initialize projects (e.g., npx nuxi@latest init), install dependencies, and run database migrations. These operations are consistent with the skill's purpose.
[PROMPT_INJECTION]: The template system processes user-provided strings (e.g., project names) through placeholders like {{name}} which are then used in shell commands. This represents an indirect prompt injection surface. Ingestion points: User-provided project names and feature descriptions in SKILL.md. Boundary markers: None explicitly defined for user-provided variables in templates. Capability inventory: Shell execution via Bash, file modification via Write/Edit, and cross-agent calls via the Agent tool. Sanitization: No explicit sanitization or validation of user-provided project names or parameters is documented in the instructions.

app-builder