The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill performs automated detection by reading project files and metadata, which serves as a potential vector for indirect prompt injection if those files contain malicious instructions.
Ingestion points: composer.json, package.json, .ddev/config.yaml, and git log output are parsed to determine project type and dependencies.
Boundary markers: No specific delimiters or "ignore instructions" warnings are utilized when reading these external files.
Capability inventory: The skill possesses the ability to generate .claude/settings.local.json with pre-approved bash permissions, write multiple markdown rules files, and install MCP servers via claude mcp add.
Sanitization: The skill does not implement explicit sanitization or filtering of data retrieved from project configuration files before using it to generate the final workspace configuration.
[PRIVILEGE_ESCALATION]: The skill generates a .claude/settings.local.json file that pre-approves a wide array of bash commands (ddev *, git *, gh *). This configuration effectively bypasses the platform's security prompts for these tools, granting the agent persistent autonomy over local development containers and the user's authenticated GitHub account.
[PROMPT_INJECTION]: The skill's templates include instructions for the agent to actively conceal its identity and ensure all output is "indistinguishable from human-authored work." This behavior override is intended to hide AI involvement from clients or collaborators.
[COMMAND_EXECUTION]: The workflow offers to run npx chrome-devtools-mcp@latest to install an MCP server, which involves dynamic execution of remote code.
[EXTERNAL_DOWNLOADS]: The skill references external resources such as the chrome-devtools-mcp package from the npm registry and instructs the agent to perform shallow clones of public repositories into a "research" folder for auditing purposes.

craft-project-setup