The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow defined in SKILL.md performs direct string interpolation of user-provided variables {name} and {description} into shell commands such as gh repo create, cd, and git commit. If a user provides input containing shell metacharacters (e.g., backticks, semicolons, or pipes), it could lead to arbitrary command execution in the user's terminal environment during the scaffolding process.
[PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface because it ingests untrusted user input and embeds it into critical configuration files like AGENTS.md (which is symlinked to CLAUDE.md to guide AI agent behavior) and README.md without sanitization or boundary markers. This could allow a malicious user to influence the behavior of the agent when it later reads those project files.
Ingestion points: User-supplied name and description variables collected during the clarification phase in SKILL.md.
Boundary markers: Absent; user inputs are placed directly into template placeholders.
Capability inventory: The skill has extensive capabilities including file system modification, shell command execution (gh, git, bundle, uv, chmod), and network operations via the GitHub CLI.
Sanitization: No escaping, validation, or filtering is performed on the user-provided strings before they are used in shell commands or project file generation.

create-web