The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-provided variables such as {project}, {language}, and {sdk_path} directly into shell commands including mkdir -p {project}/src/{language}, ls {project}/docs/..., and cd {sdk_path} && git diff. This pattern represents an indirect command injection surface where an attacker-controlled file path or language string containing shell metacharacters could lead to arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The skill uses npx to execute development tools such as vitest, tsc, and tsup. These commands may fetch packages and their dependencies from the public NPM registry at runtime.
[REMOTE_CODE_EXECUTION]: The orchestration logic executes sub-skills and validation scripts (npx vitest) against code generated by the agent. While standard for development workflows, this involves the execution of code derived from external or dynamically generated sources.

generate-sdk