The Agent Skills Directory

[COMMAND_EXECUTION]: The skill heavily relies on executing shell commands to perform its core functions.
Uses gh repo create and gh repo clone for repository management.
Executes pnpm install, pnpm run lint, pnpm run test, and pnpm run build within the cloned environment.
Uses git commit and git push to synchronize changes to remote repositories.
[EXTERNAL_DOWNLOADS]: The skill downloads content from external sources to initialize the project.
Clones a template repository from github.com/dsh-tauri/starter-plugin.
Downloads Node.js dependencies via pnpm from configured package registries.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied ideas, descriptions, and names, which are interpolated into repository metadata and CLI commands, creating an attack surface for indirect injection.
Ingestion points: User input for plugin behavior, description, owner/repository names, and package names in SKILL.md.
Boundary markers: The instructions mandate quoting arguments and substituting validated values, though it relies on the AI to perform this correctly.
Capability inventory: Includes the ability to create/modify GitHub repositories, execute shell commands via pnpm, and push code to remote repositories.
Sanitization: Explicitly instructs the agent to "Validate owner/repository and package names as data, quote arguments, reject path traversal".

dsh-plugin-creator