The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill gathers project configuration such as the project name and network type from user input and interpolates these values directly into file templates, paths, and shell commands. This creates a surface where malicious user input could potentially influence the scaffolding process.
Ingestion points: Project name, mode, and network type gathered in Phase 1 of SKILL.md.
Boundary markers: No specific delimiters or instructions to ignore potential commands embedded in user-provided input are present.
Capability inventory: The skill performs file creation and executes shell commands including yarn install, nvm use, and git init.
Sanitization: The instructions do not specify any validation, filtering, or escaping for user-provided strings before their use.
[CREDENTIALS_UNSAFE]: The .env.example template in references/monorepo.md includes a hardcoded MNEMONIC string.
Evidence: MNEMONIC="denial kitchen pet squirrel other broom bar gas better priority spoil cross" in references/monorepo.md.
Context: This mnemonic is the standard, publicly known pre-funded account for the VeChain Thor solo node intended for local development. However, hardcoding mnemonics in templates is a security anti-pattern.
[COMMAND_EXECUTION]: The skill utilizes shell commands to initialize and verify the scaffolded project.
Evidence: yarn install, git init, nvm use, and make solo-up mentioned in SKILL.md and references/monorepo.md.
Context: These commands are standard for the intended purpose of setting up a local development environment and repository.
[EXTERNAL_DOWNLOADS]: The skill configuration involves downloading external software images.
Evidence: The docker-compose.yaml in references/monorepo.md pulls the ghcr.io/vechain/thor:latest image.
Context: The image originates from the official vendor's GitHub Container Registry and is used for running a local blockchain node.

create-vechain-dapp