The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to execute local Deno scripts (scaffold.ts and validate-skill.ts) for project maintenance. These scripts are invoked with restricted permissions in their shebangs, specifically --allow-read and --allow-write, limiting their access to the local filesystem without network capabilities.
[DYNAMIC_EXECUTION]: The scaffold.ts script functions by generating new TypeScript files (.ts) from embedded templates. These generated files are intended to serve as the functional core of newly created skills, representing the automated generation of executable code as part of its primary utility.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for user-provided inputs, such as skill names and types, which are interpolated into file templates. To mitigate risks like path traversal or injection during file creation, the scaffold.ts script implements regex validation (/^[a-z][a-z0-9-]*$/) on the skill name positional argument.
Ingestion points: Command-line arguments in scaffold.ts (e.g., skill name, domain, output path).
Boundary markers: Static text templates with placeholders (e.g., {{SKILL_NAME}}) are used to delimit generated content.
Capability inventory: The skill possesses filesystem read/write capabilities through Deno's standard library, used for directory creation and template writing in scaffold.ts and directory traversal in validate-skill.ts.
Sanitization: Strict regex-based validation of the skill name input ensures it conforms to safe, predictable naming conventions, preventing exploitation of filename construction.

skill-builder