The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a shell script scripts/scaffold_feature.sh that automates the generation of backend components (routes, services, tests) by applying sed transformations to template files. This script performs file system operations and is intended to be executed within the project environment.
[INDIRECT_PROMPT_INJECTION]: As a code generation assistant, the skill ingests user-provided feature requirements to produce Python code and directory structures.
Ingestion points: User-provided names and descriptions for new features (e.g., ${feature_name}, ${table_name}) are used as inputs for code templates in the templates/ directory and as arguments for the scaffold_feature.sh script.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within user input documented in the instructions.
Capability inventory: The agent has the capability to write files to the repository (e.g., src/backend/api/routes/v1/), execute shell scripts, and perform database migrations via Alembic.
Sanitization: The scaffold_feature.sh script does not sanitize the arguments $FEATURE, $FEATURE_CAP, or $TABLE before using them in file path construction or sed commands, which creates a potential path traversal surface if the agent is instructed to use malicious strings provided by a user.

hugagent-backend-dev