The Agent Skills Directory

[SAFE]: The skill performs routine project initialization tasks. It interacts with the environment to install and configure established developer tools.
[COMMAND_EXECUTION]: The skill uses package manager commands (e.g., npm, pnpm, bun, yarn) to install dependencies and set up Git hooks via Husky. These commands are restricted to the intended purpose of project setup.
[EXTERNAL_DOWNLOADS]: The skill downloads developer tools from the official npm registry. These are well-known, industry-standard packages.
[DATA_EXPOSURE]: No access to sensitive user files, credentials, or environment variables was detected. The file access is limited to project configuration files like package.json and tool-specific JSON/YAML files.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential attack surface by reading external project files to determine configuration state.
Ingestion points: package.json, lockfiles (pnpm-lock.yaml, yarn.lock, etc.), and existing configuration files (e.g., biome.json, .husky/).
Boundary markers: None present for the file content reading phase.
Capability inventory: Includes Bash command execution for package installation and Write/Edit for configuration file management.
Sanitization: No explicit sanitization or validation of the content of the read files is performed before decision making.
Although the surface exists, the logic is restricted to checking for the existence of files or keys, which is a low-risk operation in this context.

setup