The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to interact with the project environment, specifically using npx to refresh the skill registry (npx @ericrisco/rsc registry refresh) and to install new skills (npx @ericrisco/rsc add <skill>). These commands are used for their primary purpose of environment calibration.
[EXTERNAL_DOWNLOADS]: The skill fetches and installs external packages and registry updates from the @ericrisco NPM namespace. These resources are recognized as belonging to the skill's author and are used to equip the repository with necessary tools based on the detected stack.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests data from untrusted repository files, including package.json, pyproject.toml, requirements.txt, and Dockerfiles.
Ingestion points: Project configuration files (package.json, go.mod, etc.) and the config.yaml file processed in SKILL.md.
Boundary markers: The skill does not explicitly use delimiters when reading these files, though it applies specific detection logic to map content to signals.
Capability inventory: The skill has the ability to execute shell commands via npx and write configuration files to the disk.
Sanitization: No explicit sanitization or filtering of the content read from the project files is mentioned before processing.

sdd-init