The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill uses hardcoded default credentials (e.g., admin / Joh316!!) for the TYPO3 backend and local database access (root / root) across multiple template files and setup scripts. These are documented as standard defaults for the generated local development environment and are common practice for tools like DDEV.
[COMMAND_EXECUTION]: The skill includes shell scripts and configuration hooks designed to manage the local Docker/DDEV environment. These include operations like creating directories, running database queries, and managing containers via the ddev and docker CLIs. These are legitimate functions of the skill's purpose.
[DYNAMIC_EXECUTION]: The skill generates project-specific configuration files (such as Makefile and index.html) at runtime using templates and sed-based interpolation. It also utilizes DDEV hooks to execute commands inside the web container to capture environment metadata.
[EXTERNAL_DOWNLOADS]: The skill's documentation and validation scripts reference the official DDEV installation script from its GitHub repository (https://raw.githubusercontent.com/ddev/ddev/master/scripts/install_ddev.sh). As DDEV is a well-known and trusted development tool, these references are safe and provided for user guidance.
[INDIRECT_PROMPT_INJECTION]: The skill generates scripts and landing pages by extracting metadata from the project's composer.json and directory structure. While there is basic escaping, this represents a minor attack surface typical of templating tools, which is acceptable in a local development context.

typo3-ddev