The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/scaffold.py executes system commands via subprocess.run to handle project initialization with npx and yarn. On Windows platforms, the script utilizes shell=True to facilitate binary resolution. These operations are core to the skill's primary purpose of scaffolding development projects and follow industry standard practices for tooling.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of dependencies from established sources, including the @backstage and @red-hat-developer-hub NPM scopes. It also provides instructions for adding community tools from the official backstage.io domain, which is a well-known service in the development ecosystem.
[PROMPT_INJECTION]: The skill incorporates a context-detection mechanism via scripts/detect-rhdh-context.py which parses local project files to influence the agent's implementation strategy. This represents an indirect prompt injection surface.
Ingestion points: Local package.json and source code files (e.g., src/index.ts, src/plugin.ts) are read and regex-matched to identify the plugin's architecture and system dependencies.
Boundary markers: None identified in the scripts or instructions to isolate or ignore untrusted content within the analyzed project files.
Capability inventory: The skill possesses capabilities including local file system modification (plugin authoring), shell command execution via the scaffolding script, and dependency management through package managers.
Sanitization: Standard regex and JSON parsing are used, but no specific security validation or filtering is applied to the content of the analyzed files.

rhdh-plugin-authoring