The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include a command to install dependencies (npm ci --prefix "$SKILL_DIR" --ignore-scripts). This is a standard project initialization step and uses the --ignore-scripts flag to prevent the execution of potentially malicious scripts during installation.\n- [COMMAND_EXECUTION]: The skill invokes a local validation script (node "$SKILL_DIR/scripts/validate.mjs") to check the generated JSON files against a schema. The script logic is focused entirely on reading a file, parsing JSON, and performing schema validation using the @webmcp-today/schema package.\n- [DATA_EXPOSURE]: The skill explicitly instructs users and the agent to never print, save, or store credentials, tokens, cookies, or session headers. It mandates redacting sensitive information from request logs and evidence reports.\n- [EXTERNAL_DOWNLOADS]: The skill downloads the @webmcp-today/schema package and its dependencies from the official npm registry. These are well-known packages used for schema validation and URL parsing (zod, tldts, jmespath).

create-webmcp-package