The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection and command injection through user-provided parameters. Maliciously crafted project names or descriptions could potentially escape the intended shell commands.
Ingestion points: User-provided project_name, project_description, and python_version in SKILL.md (Step 1).
Boundary markers: None identified. Instructions do not include delimiters or warnings to ignore instructions embedded in the project metadata.
Capability inventory: The skill executes multiple shell commands using uv, git, curl, mkdir, and touch across SKILL.md (Steps 2 through 9).
Sanitization: No validation, escaping, or filtering of user-supplied input is performed before interpolation into shell commands (e.g., uv init --name={{project_name}}).
[EXTERNAL_DOWNLOADS]: The skill fetches a project configuration file from a remote source at runtime.
Finding: Downloads a standard .gitignore template from GitHub's official repository: https://raw.githubusercontent.com/github/gitignore/refs/heads/main/Python.gitignore.
Context: This is a standard practice for initializing new Python projects and targets a well-known technology service.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution to set up the development environment.
Finding: Invokes uv, git, and curl to manage dependencies, version control, and file downloads. It also runs Python code snippets directly from the command line (e.g., uv run python -c 'from {{project_name}} import __version__; print(__version__)').

python-initializr