The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for building interactive CLI tools that resolve configuration from environment variables, project files, and global config files. This ingestion of external data creates a potential surface for indirect prompt injection if the data is not handled carefully, though the skill provides standard development practices.
Ingestion points: The resolveSource function in examples/wizard-patterns.md reads from environment variables (e.g., MYAPP_SOURCE), project config files, and global config files in the user's home directory (~/.myapp/config.yaml).
Boundary markers: The templates do not explicitly define LLM boundary markers, as they are intended for standard Node.js execution, but they do include input validation logic for user prompts.
Capability inventory: The code examples are focused on CLI structure, option parsing, and interactive UX. They do not implement arbitrary command execution or suspicious network operations.
Sanitization: The getProjectName example in examples/core.md demonstrates input validation using regex to restrict characters to lowercase letters, numbers, and hyphens.

cli-framework-cli-commander