The Agent Skills Directory

[SAFE]: The skill performs its stated purpose of project bootstrapping without any detected malicious intent or security violations.- [COMMAND_EXECUTION]: The script scripts/project_bootstrapper.py performs file system operations such as creating directories and writing boilerplate files using standard Python libraries. This functionality is essential for the skill's operation and is implemented in a transparent manner.- [EXTERNAL_DOWNLOADS]: The generated project configuration files (package.json and requirements.txt) reference well-known, industry-standard packages from official registries (npm and PyPI). These include frameworks like Next.js, React, FastAPI, and Pydantic.- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because user-provided metadata like product names and descriptions are interpolated into generated files such as README.md. 1. Ingestion points: User configuration input in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Local file system creation via Python script. 4. Sanitization: Absent for markdown content generation. This is considered a low-risk surface inherent to a code generator.

saas-scaffolder