The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Python scripts (project_scaffolder.py, code_quality_analyzer.py, fullstack_decision_engine.py) designed for local development tasks. These scripts perform standard file system operations such as creating directories, writing boilerplate files, and reading source code for analysis. Analysis of the scripts shows they are implemented using the Python standard library and do not execute arbitrary user-provided shell commands.
[CREDENTIALS_UNSAFE]: The skill contains various placeholders for secrets in its scaffolding templates (e.g., SECRET_KEY: str = "change-me-in-production" in project_scaffolder.py and JWT_SECRET="development-secret-change-in-prod" in documentation). These are clearly identified as placeholders meant to be replaced by the user during deployment and do not represent a credential leak.
[INDIRECT_PROMPT_INJECTION]: The code_quality_analyzer.py script reads source code from a project directory to perform analysis. While this is an ingestion point for untrusted data, the script uses regular expressions for static analysis and does not interpret the code in a way that would trigger execution of embedded instructions. The severity is low as it is the primary purpose of a code analysis tool.
[SAFE]: All external references in the documentation and configuration files target well-known services (e.g., Vercel, Cloudflare, Netlify) or official repositories (e.g., JSON Schema). The project scaffolding templates follow best practices for Next.js, FastAPI, and other common stacks.

senior-fullstack