The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute system commands to initialize the project, including composer create-project, composer require, npm install, and pnpm install. It also includes a shell script (scripts/init.sh) that manages directory structures and performs template variable replacement. These are standard operations for a scaffolding tool and operate within the user-specified project path.
[CREDENTIALS_UNSAFE]: The database seed template (templates/database/seed.sql) includes a default administrator account with a hardcoded password hash ('admin123456'). While hardcoded credentials are a risk factor, this is a standard feature for local project initialization, and the skill's documentation explicitly warns users to change the password immediately after the first login.
[EXTERNAL_DOWNLOADS]: The skill initialization process involves downloading the Webman framework and various Node.js and PHP dependencies from official public registries (NPM and Composer). These references target well-known, legitimate software repositories and are necessary for the skill's intended purpose.
[INDIRECT_PROMPT_INJECTION]: The scaffolded application creates an attack surface by processing external JSON data via multiple API endpoints. The skill mitigates this by providing a comprehensive security architecture in its templates, including mandatory JWT authentication, explicit route registration to prevent unintended endpoint exposure, and centralized validation middleware.

webman-react-scaffold