The Agent Skills Directory

[SAFE]: The skill implements a 'security-first' approach to project bootstrapping. It explicitly defines patterns to skip sensitive files such as .env, *credentials*, *secrets*, *token*, and cryptographic keys (.key, .pem, .crt).
[COMMAND_EXECUTION]: The skill uses standard shell commands (find, grep, sed, bc, stat) within its helper scripts to perform local file system operations (scanning files, calculating sizes). These operations are restricted to the local directory structure and do not involve remote execution or network access.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied documentation from the .in/ folder. While this presents a theoretical injection surface, the risk is mitigated by the skill's design: it summarizes content or includes it as reference material without executing code based on the document's content. The 'AskUserQuestion Guard' is a UI-specific handling mechanism for the agent's interface and does not introduce security vulnerabilities.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. All scripts are local to the skill and dependencies are not fetched from external sources.

create-context