The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use git and gh (GitHub CLI) for repository discovery and administrative configuration.
Commands such as git remote -v, gh repo edit, and gh api are used to manage project settings and GitHub Rulesets.
These operations are fundamental to the skill's purpose of setting up a project environment.
Security risk is managed by requiring explicit user confirmation before any state-changing commands are executed.- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of additional agent skills via the command npx skills add Firzus/agent-skills.
This command refers to a package in the author's own library on npm, a well-known service.
The installation is presented as a recommendation for the user to execute manually in the target project, rather than being performed automatically by the skill.- [DATA_EXFILTRATION]: The skill performs local information gathering using git remote -v and git symbolic-ref.
This data is used solely to provide project context (e.g., identifying if the host is GitHub and determining the default branch) to customize the generated configuration fragments.
There is no indication that sensitive information is being transmitted to external or unauthorized servers.- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes data from the target repository to generate configuration blocks.
Ingestion points: The skill reads repository signals from files such as package.json, Cargo.toml, and other build/configuration files located in the project root.
Boundary markers: Content generated by the skill is wrapped in HTML-style comment markers () to maintain a clear source of truth and separate generated rules from other content.
Capability inventory: The skill possesses capabilities for file system read/write access and shell command execution (git, gh).
Sanitization: Content read from project files is interpolated into markdown fragments without explicit escaping or sanitization, though the risk is limited to the local environment and the generated documentation.

setup-project