The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Node.js packages from the official NPM registry via npm install and npx during the project bootstrapping phase to install required dependencies.
[COMMAND_EXECUTION]: The skill executes various shell commands to set up the project environment, including git init, ln -s, npm install, and npx ultracite init. It also verifies the generated CLI tool by executing the resulting binary with node dist/cli.js.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface (multi-step chain) in the generated project:
Ingestion points: User-provided inputs for {{name}} and {{description}} are gathered in Step 1 of SKILL.md.
Boundary markers: No delimiters or safety instructions are used when interpolating these variables into file templates.
Capability inventory: The skill writes new agent skill files and documentation and executes shell commands in references/post-scaffold.md.
Sanitization: There is no evidence of sanitization or validation of the input strings before they are written to the generated SKILL.md and README.md files.

scaffold-cli