The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to automate the project lifecycle. It uses specialized tools like moi init and mo init for repository creation, and the GitHub CLI (gh repo edit and gh api) for repository configuration. It also utilizes task runners like just and environment-specific tools like cargo and vp (Vite+) to validate and build the project infrastructure.
[EXTERNAL_DOWNLOADS]: The skill triggers the download and installation of numerous development dependencies. This includes Rust utilities (e.g., insta, dprint, cargo-shear) installed via cargo and JavaScript packages (e.g., typescript, vite, @liangmi/vp-config) installed via npm, pnpm, or vp. These downloads originate from standard, well-known package registries or official vendor repositories.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a templating engine that consumes user-provided metadata, such as project names and descriptions, creating a surface for indirect prompt injection.
Ingestion points: User input is incorporated into README.md, package.json, Cargo.toml, and GitHub API calls via placeholders.
Boundary markers: The skill employs {{placeholder}} syntax and requires the agent to manually resolve and fill {{TODO: ...}} markers.
Capability inventory: The skill has broad file-writing access and the ability to execute shell commands for project and repository configuration.
Sanitization: The instructions require the agent to perform a diff of every generated file against its template and to verify all placeholders before completing the task, providing a human-in-the-loop and agent-verification barrier against malicious payloads.

creating-projects