The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates .claude/settings.json files that configure PostToolUse and Stop hooks. These hooks automatically execute shell commands such as ruff, npx biome, and npx tsc to provide automated linting, formatting, and type-checking after file modifications.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided arguments through $ARGUMENTS to determine the project template and establishes an environment where the agent processes files that may contain untrusted data.
Ingestion points: User-supplied arguments in SKILL.md used for project type selection.
Boundary markers: None explicitly defined in the templates for ignoring embedded instructions in the generated code, though standard project structures are followed.
Capability inventory: Generated configurations grant permissions for Bash commands (e.g., uv, pytest, npm, npx) allowing the agent to execute development tools.
Sanitization: The execution hooks use python3 to safely parse JSON inputs from tool results and employ shell quoting for file paths to mitigate command injection risks.
[EXTERNAL_DOWNLOADS]: The generated configuration for Next.js projects uses npx to run tools like biome and tsc. These commands may trigger downloads from the official npm registry, which is a well-known and trusted service for development dependencies.

project-template