The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The references/android-project.md file instructs users to add a Maven repository hosted on a personal GitHub account (https://npm.pkg.github.com/nickalcala/meta-spatial-sdk) to fetch core SDK components such as spatial-sdk-core and spatial-sdk-panel. Using a personal account for official SDK dependencies is a significant supply chain risk, as the integrity and safety of the hosted code cannot be verified against official vendor standards.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx and npm create commands (e.g., npx -y metavr, npm create @iwsdk@latest) which download and execute code from public registries at runtime. This provides a vector for executing unverified remote code during the project scaffolding process.
[DYNAMIC_EXECUTION]: In references/unity-project.md, the setup process involves injecting a custom C# script (MetaQuestVRSetup.cs) into the Unity project and configuring it to run automatically when the editor is opened. This mechanism allows for the automated execution of arbitrary code within the developer's environment.
[COMMAND_EXECUTION]: The skill requires access to powerful shell tools (Bash, npx) to perform its scaffolding tasks. While these tools are used for project initialization, the lack of strict boundaries when combined with remote code fetching increases the overall attack surface.

hz-new-project-creation