The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several developer-centric commands, including npm, poetry, pip, pytest, and uvicorn. These are implemented using a central helper function in _skill_cli.py which utilizes subprocess.run with shell=False and absolute path resolution via shutil.which. This approach effectively prevents command injection vulnerabilities by ensuring that arguments are never parsed by a shell.
[EXTERNAL_DOWNLOADS]: The skill includes functionality to install project dependencies using npm install and pip install. These operations are triggered by specific engineering tasks (e.g., ensure_npm, ensure_python) and target standard, official package registries. This behavior is consistent with the primary purpose of a project scaffolding tool.
[SAFE]: No evidence of malicious behavior, obfuscation, or unauthorized data exfiltration was found. All scripts and templates are focused on legitimate development workflows, and the skill correctly encourages the use of .env files and local emulators for handling sensitive configuration.

project-engineering