The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of a local TypeScript script via bun run .claude/skills/create-element/scripts/scaffold-element.ts to perform its primary function of scaffolding new elements.
[DYNAMIC_EXECUTION]: The scaffolding script scaffold-element.ts performs dynamic code generation by writing TypeScript and JSON files to the filesystem based on user input and pre-defined templates.
[INDIRECT_PROMPT_INJECTION]: The scaffold-element.ts script is vulnerable to path traversal because it constructs filesystem paths using the unsanitized category and name arguments. An attacker could potentially cause the agent to create or overwrite files in unauthorized directories by providing crafted names (e.g., using ../).
Ingestion points: The category and name command-line arguments passed to the scaffolding script as defined in the Quick Start section (SKILL.md).
Boundary markers: None identified in the script or instructions to prevent processing of malicious path sequences or to delimit untrusted input.
Capability inventory: The script uses mkdir with recursive: true and writeFile to create directories and files (scripts/scaffold-element.ts).
Sanitization: There is no validation, normalization, or escaping of the category or name variables before they are used in path construction.

create-element