The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell commands to install project dependencies using the detected package manager (pnpm install or bun install).
[COMMAND_EXECUTION]: The skill modifies file permissions by executing chmod +x on the newly created Husky hook scripts (.husky/pre-commit, .husky/pre-merge).
[EXTERNAL_DOWNLOADS]: The skill configures project dependencies for JavaScript and Rust projects, which are downloaded from public registries like NPM and Crates.io.
[EXTERNAL_DOWNLOADS]: The generated GitHub Action workflows fetch and execute official and community-maintained actions from the GitHub Marketplace (e.g., actions/checkout, pnpm/action-setup, dtolnay/rust-toolchain).
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted local project data to determine its execution path and configuration content.
Ingestion points: Project files like package.json and Cargo.toml (SKILL.md).
Boundary markers: None identified.
Capability inventory: File writing, shell command execution (package managers), and file permission modifications (SKILL.md).
Sanitization: No explicit sanitization or validation of the ingested project metadata before it is used to modify the environment.

ci