The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to interact with system tools such as npx and cclsp for managing LSP plugins. These calls are implemented securely using argument lists instead of raw shell strings, and all dynamic inputs (like plugin names) are validated against a strict alphanumeric regex (r"^[a-zA-Z0-9_-]+$") to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill automates the download and installation of LSP plugins from the npm registry using npx cclsp install. This behavior is the primary intended function of the skill and is clearly documented. It does not automatically install system-level binaries, instead providing instructions for the user to perform those actions manually.
[SAFE]: Configuration management is restricted to the local project environment, modifying only .env and .claude/settings.json files. The skill includes safety features such as automatic backups of the .env file before modification and strict directory scoping to the project root.

lsp-setup