The Agent Skills Directory

[SAFE]: The skill does not contain any malicious patterns such as obfuscation, credential exfiltration, or unauthorized persistence mechanisms.
[EXTERNAL_DOWNLOADS]: References official documentation and source repositories for well-known services and organizations, including Microsoft, GitHub, TanStack, Vercel, and the Effect-TS project. These are used for developer reference and do not involve unverified remote code execution.
[COMMAND_EXECUTION]: Includes templates for common development commands (e.g., bun run, uv run, cargo clippy, ruff check). These are standard toolchain operations intended for local development environments and CI/CD configurations.
[PROMPT_INJECTION]: The scaffolding files utilize placeholder variables (e.g., {project-name}, {name}, {command}) to generate project structures. While this constitutes an attack surface for indirect prompt injection if the source input is adversarial, it is a standard implementation for scaffolding utilities.
Ingestion points: Variables used in scaffolds/python-app.md, scaffolds/ts-monorepo.md, and other template files.
Boundary markers: Not present within the templates themselves.
Capability inventory: File system write operations (performed by the agent using its own tools based on the templates).
Sanitization: Not explicitly defined in the markdown templates.

techstack