The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local script scaffold-project.mjs to automate project creation. This script executes git ls-files to identify source files from a reference project. User-provided project names and references are validated against a strict kebab-case regex, effectively preventing command injection and path traversal.
[PROMPT_INJECTION]: The scaffolding process accepts a user-provided description. The script implements basic sanitization by rejecting input containing newlines or comment terminators (*/) to prevent breaking generated code structures or docstrings.
[DATA_EXFILTRATION]: The skill operates entirely within the local file system and the current repository. There are no network operations to external domains or access to sensitive global files (e.g., SSH keys, AWS credentials).
[REMOTE_CODE_EXECUTION]: The skill executes a bundled Node.js script. This script performs file system operations (read/write) and uses standard local tools (git, pnpm, mise) to manage the workspace. No remote code is downloaded or executed.

authoring-projects