The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (e.g., component names, hook points, and API names) which is then interpolated into shell commands to generate files on the local system.
Ingestion points: User-supplied strings for parameters like --name and --option in SKILL.md examples.
Boundary markers: None present in the skill instructions to delimit user input or instruct the agent to ignore embedded commands within those inputs.
Capability inventory: The skill utilizes shell execution via the b2c and npx commands to perform filesystem writes and directory creation across SKILL.md.
Sanitization: There are no instructions for the agent to validate or sanitize the input before passing it to the CLI tool.
[COMMAND_EXECUTION]: The skill relies on executing the b2c command-line interface or npx @salesforce/b2c-cli to perform its primary function of scaffolding components. These are standard operations for development tools.
[EXTERNAL_DOWNLOADS]: The skill recommends using npx @salesforce/b2c-cli, which involves downloading and executing the CLI tool from the public NPM registry. The package is provided by Salesforce, a well-known service.

b2c-scaffold