The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses a placeholder <project-name> in a shell command which is intended to be replaced by user input. This creates a surface for indirect prompt injection and command injection if the input contains shell metacharacters, as no sanitization or boundary markers are specified in the instructions.
[COMMAND_EXECUTION]: The agent is instructed to execute shell commands to scaffold the project and manage dependencies: npx --package yo --package generator-code -- yo code <project-name> --template typescript --quick and npm install.
[EXTERNAL_DOWNLOADS]: The skill fetches and executes initialization tools (yo, generator-code) from the npm registry at runtime via npx.

vscode-project-init