The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes a reference to the official installation script for uv (https://astral.sh/uv/install.sh). This is a well-known and reputable tool in the Python development community, and the script is fetched from the developer's official domain.
[COMMAND_EXECUTION]: The instructions require the agent to execute shell commands for project initialization and dependency management, such as uv init, uv sync, and pip install. These commands are standard for the tool's stated purpose of project scaffolding.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided tool names and descriptions which are then interpolated into generated project files (e.g., pyproject.toml, README.md). While this presents a surface for indirect prompt injection where a malicious description could influence the generated code, it is the primary intended function of the scaffolding utility, and the impact is contained within the generated project files.

scaffold-security