The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill initializes project documentation by ingesting external data such as the project name from package.json and directory names from the apps/ folder. This content is then interpolated into templates (README.md, AGENTS.md) using sed. While there are no specific boundary markers for this untrusted data, the script includes a sanitization function (escape_sed) to prevent command injection during the substitution process. The resulting impact is limited to the generation of static Markdown files.
[COMMAND_EXECUTION]: The skill includes a local bash script (scripts/init.sh) and a test suite (tests/init.bats). These scripts perform standard filesystem operations such as creating directories (mkdir), resolving paths, and writing files. The operations are scoped to the project directory provided by the user.
[REMOTE_CODE_EXECUTION]: The documentation references an external dependency grill-with-docs. However, the skill does not automatically download or execute this tool; it instead prompts the user to install it if missing and provides a built-in fallback workflow for doc-aware interrogation.

product-development