The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses node to run its internal scaffolding scripts and pnpm (via corepack) to install dependencies, run build tasks, and execute smoke tests for newly created projects. This behavior is confined to the project directory and is standard for development tools.
[EXTERNAL_DOWNLOADS]: The skill's registry utility (registry.js) performs HTTP requests to the official npm registry (registry.npmjs.org) to fetch package metadata and resolve latest versions. This is a legitimate use of network access for JavaScript dependency management.
[INDIRECT_PROMPT_INJECTION]: The skill reads project specifications from PRD.md files or user prompts to drive its dApp template generation logic. While this represents a data ingestion surface, it is controlled within a structured development workflow with predefined templates, and the skill includes procedures for verification and human review.

xl1-scaffold