The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (project names, taglines, and code snippets) and interpolates this data into a README.md file using placeholders in templates/README.template.md. While this creates an injection surface, the skill is limited to file-writing operations within its own scope.
[SAFE]: The skill implements a proactive security guardrail in its instructions, mandating that the agent scan user-provided code hooks for secrets, tokens, and environment variables, replacing them with placeholders to prevent data exposure in public documentation.
[SAFE]: All external URLs and resources referenced in the templates and reference guides target well-known package registries (NPM, Packagist), official developer services (GitHub, Shields.io, Semantic Versioning), or the author's own verified infrastructure.

write-readme