The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/scaffold.py script executes system commands to automate the creation of Backstage applications and plugins using subprocess.run.
Evidence: The script calls npx, yarn install, and yarn new to generate project structures and install dependencies.
Context: These operations are necessary for the skill's primary function of scaffolding new development projects.
[PROMPT_INJECTION]: The skill processes user-defined inputs, such as plugin IDs and RHDH versions, which are interpolated into shell commands executed by the scaffolding script.
Ingestion points: The plugin_id and rhdh_version parameters provided by the user are passed as arguments to scripts/scaffold.py.
Boundary markers: No explicit delimiters or boundary markers are used to isolate user input from the surrounding shell command syntax.
Capability inventory: The script performs file system operations and executes external binaries like yarn and npx.
Sanitization: The script does not perform explicit sanitization or validation of user-provided strings before they are passed to the underlying shell environment, representing a vulnerability surface for indirect prompt injection.

create-frontend-plugin