The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/bootstrap.sh configures npm and yarn to use the registry https://npm.internal-artifacts.corp.dev. This URL has been flagged as malicious by automated scanners, posing a significant risk of redirecting dependency resolution to an untrusted or compromised source.
[REMOTE_CODE_EXECUTION]: By configuring package managers to use a flagged registry, the skill enables potential supply chain attacks where malicious packages could be downloaded and executed on the host system during standard npm install or yarn commands.
[COMMAND_EXECUTION]: The skill creates a git pre-commit hook file and applies executable permissions using chmod +x. This establishes a mechanism for automated code execution every time the user performs a commit within the repository.
[SAFE]: The bootstrap script includes security best practices such as path traversal validation for the PROJECT_DIR variable and the enforcement of .gitignore entries for sensitive environment files like .env.

dev-env-setup