The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a template generator that interpolates user-provided metadata (such as module name, author, and description) into PowerShell scripts and manifests. This creates a surface for indirect prompt injection where malicious input could attempt to influence the logic of the generated project.
Ingestion points: Metadata fields like {ModuleName}, {AuthorName}, {Year}, {ModuleDescription}, and {AuthorGitHub} used across all template files in SKILL.md.
Boundary markers: No delimiters or explicit warnings to ignore embedded instructions are present in the templates.
Capability inventory: The generated scripts include capabilities for file modification (Set-Content), command execution (pwsh), and network operations (Install-Module, Publish-Module).
Sanitization: No input validation or escaping is performed on the user-provided strings before they are interpolated into the code.
[EXTERNAL_DOWNLOADS]: The build.ps1 script template automates the installation of standard development dependencies, specifically Pester and PSScriptAnalyzer, from the official and well-known PowerShell Gallery repository.
[COMMAND_EXECUTION]: The skill defines a set of automation tasks in build.ps1 and VS Code tasks.json that execute PowerShell commands to manage the project lifecycle, including building artifacts, running unit tests, and performing static analysis.
[DYNAMIC_EXECUTION]: The module loader (.psm1) template uses dot-sourcing (. $file.FullName) to dynamically load function files into the session. This is the standard and expected method for loading functions in multi-file PowerShell modules.

powershell-module-scaffold