The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the development lifecycle, including npm install, npm init, and various tapcart CLI subcommands such as auth, block, dependency, lint, log, and layout. These are standard operations for a developer tool.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs official vendor packages from the npm registry, specifically @tapcart/tapcart-cli and @tapcart/tapcart-app. These are legitimate tools provided by the author for the intended project management tasks.
[INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied input (App ID and folder name) and interpolates them into shell commands during project initialization. While this creates an attack surface, the risk is minimal given the developer-focused use case.
Ingestion points: User input for <app-id> and <folder-name> in the npm init step.
Boundary markers: No specific boundary markers are defined in the instructions to delimit user input from the shell command structure.
Capability inventory: The skill possesses command execution capabilities through the global CLI and npm package manager.
Sanitization: No explicit sanitization or escaping of the user-provided strings is described in the skill instructions.

tapcart-project