The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx and npm install to set up the project environment and install dependencies. It also performs git init and git commit operations. These are standard actions for a developer-oriented project setup skill.
[EXTERNAL_DOWNLOADS]: The skill fetches libraries from the npm registry. The specified packages (@supabase/ssr, @ai-sdk/google, posthog-js, @sentry/nextjs, etc.) are official libraries from well-known technology providers and cloud services.
[INDIRECT_PROMPT_INJECTION]: The skill interpolates a user-provided project name directly into shell commands, which presents a surface for potential injection if the underlying agent does not sanitize inputs.
Ingestion points: The [project-name] placeholder in SKILL.md is populated by user input.
Boundary markers: No boundary markers or specific delimiters are used to wrap the input.
Capability inventory: The skill utilizes subprocess execution via npx, npm, and git commands.
Sanitization: The instructions do not specify any sanitization, validation, or escaping rules for the user-supplied project name.

ncode-project-setup