The Agent Skills Directory

[SAFE]: The skill operates as a structural template generator and interactive guide. It uses standard conversational prompts to gather user requirements and provides static markdown/bash templates based on those requirements.
[DATA_EXPOSURE]: There are no hardcoded credentials or sensitive file path access. The skill includes an example hook template that demonstrates how to block access to a /secrets/ directory, which is a security best practice, not a vulnerability.
[COMMAND_EXECUTION]: While the skill provides templates containing bash commands (e.g., using jq, cat, and set -euo pipefail), these are purely for display and generation. The skill itself does not execute these commands.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user input to customize generated templates. While this is an ingestion surface, the risk is minimal as the output is a static file scaffold intended for the user's manual review and further development. No automated action is taken on the generated code.

scaffold