The Agent Skills Directory

[SAFE]: The skill facilitates the creation of interactive documentation and setup scripts, which is a common developer task. Its handling of sensitive information via the ask_secret and write_env helpers in template.sh follows security best practices, such as using silent input for credentials and standard environment file management.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it generates executable bash scripts based on content found in project configuration files. \n
Ingestion points: The skill reads .env.example, framework configs, and other project configuration files as part of its behavior checklist. \n
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from being influenced by malicious instructions embedded within these external configuration files. \n
Capability inventory: The skill is capable of writing executable scripts to the scripts/ directory, modifying local files using sed (via write_env), and executing system commands for browser launching (open_url) and script validation (bash -n, shellcheck). \n
Sanitization: The skill does not include specific requirements for sanitizing or escaping data extracted from configurations before it is included in the generated wizard scripts.
[COMMAND_EXECUTION]: The template.sh file provides utility functions that utilize shell execution. open_url uses platform-specific launchers like xdg-open or open to interact with the host system, and verify is a generic wrapper that executes arbitrary shell commands passed to it. These functions are intended for the generated script and are designed to be reviewed by the user before manual execution.

lcs-wizard