The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes user-supplied JSON specifications to drive file generation.
Ingestion points: User-provided spec.json (as described in SKILL.md).
Boundary markers: Absent; there are no instructions to the agent to delimit user data or ignore instructions embedded within the spec fields.
Capability inventory: The agent is directed to use file-writing capabilities to create files in the local repository based on the rendered templates (as per SKILL.md).
Sanitization: Absent; the instructions do not include validation for the module or name fields, which are used to construct output file paths, creating a potential risk for path traversal if not handled by the agent's core safety layers.
[NO_CODE]: The skill contains no executable scripts (Python, JavaScript, or Shell). All logic is defined through markdown instructions and templates for AI rendering, significantly reducing the direct attack surface.
[SAFE]: No evidence of direct prompt injection, hardcoded credentials, or data exfiltration was found. All external documentation links refer to the official and reputable nuqs library.

nuqs-scaffolder