The Agent Skills Directory

Command Execution: The skill guides the agent to use npx to run common project scaffolding tools like create-next-app, create-vite, and yo. It also utilizes VS Code internal commands (e.g., python-envs.createNewProjectFromTemplate) to initialize environments, which is standard behavior for development-focused skills.
External Content Retrieval: The skill instructs the agent to use the fetch_webpage tool to obtain instructions from modelcontextprotocol.io. While this is a well-known service, retrieval of external content at runtime represents a common pattern in documentation-assisted skills.
Indirect Prompt Injection Surface: The practice of fetching instructions from external websites (like modelcontextprotocol.io) to guide project setup introduces a potential surface for indirect prompt injection.
Ingestion points: The fetch_webpage tool is used to read llms-full.txt from the Model Context Protocol website in the mcp-server section.
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the fetched content.
Capability inventory: The skill allows the agent to execute shell commands via npx and write configuration files like mcp.json and copilot-instructions.md.
Sanitization: The skill does not specify explicit sanitization or validation of the fetched instructional text.

project-setup-info-local