The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow (Step 7: Verify) requires the agent to execute various shell commands to build and validate the new plugin, including pnpm install, pnpm run build, pnpm run typecheck, and pnpm run hygiene. These are standard development operations within a controlled repository environment.
[EXTERNAL_DOWNLOADS]: The pnpm install command is used to fetch project dependencies from the official NPM registry, which is a standard and well-known service for JavaScript development.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided descriptions and names to scaffold new packages, creating a surface for indirect prompt injection. However, this is mitigated by the inclusion of a "General Feedback Loop" (通用反馈闭环) which acts as a safety gate, mandating that the agent stops for user confirmation before proceeding with any external writes or commits. Furthermore, the skill includes automated validation steps like pnpm run constraints to ensure compliance with project standards.
[SAFE_PRACTICE]: The instructions explicitly mention following the repository's security and defensive patterns (e.g., docs/defensive-patterns.md), emphasizing safe development practices for lifecycle and subprocess management.

dsh-plugin-creator