Project Init

Project initialization toolkit. contributing - auto-generate CONTRIBUTING.md from project structure [contributing.md]. "init", "project init", "initialize pr...

Security Scan

The skill is an instruction-only CONTRIBUTING.md generator that only reads repository files and writes a README-style file; its requested access and instructions are coherent with that purpose.

Purpose & Capability

Name and description (generate CONTRIBUTING.md from project structure) match the instructions: the SKILL.md enumerates reading package.json, .editorconfig, lint configs, monorepo files, and producing a CONTRIBUTING.md. There are no unrelated environment variables, binaries, or install steps requested.

Instruction Scope

The SKILL.md explicitly instructs shell actions (ls, cat, jq, writing ./CONTRIBUTING.md) and to inspect repo paths (.editorconfig, package.json, .husky/, tsconfig.json, src/, packages/). This is consistent with the stated goal. Note: it assumes local file access and tools like jq; it will read project files (which is expected) and will write ./CONTRIBUTING.md but includes a confirmation step before overwriting.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is downloaded or written by an installer. Low install risk.

Credentials

No environment variables, credentials, or config paths are requested. The files the instructions read are repository-local and appropriate for generating a contributing guide.

Persistence & Privilege

always is false and the skill is user-invocable. disable-model-invocation is false (normal default), so the agent could invoke the skill autonomously — but there are no other privileged or persistent behaviors requested by the skill.

Assessment

This skill appears coherent and low-risk: it reads project files and produces a CONTRIBUTING.md. Before using it, (1) ensure you run it in a repository you trust and that no sensitive secrets reside in package.json or other scanned files; (2) back up any existing CONTRIBUTING.md (the skill says it will confirm before overwriting, but a manual backup is prudent); (3) ensure required local tooling (e.g., jq) is available if running the example commands; (4) be aware the skill runs local file-read/write actions — if you run agents with broad filesystem or network permissions, consider running this in a sandbox or limiting the agent's repository access. No network exfiltration or credential access is requested by the skill as provided.

Init

Project initialization toolkit — scaffolding, boilerplate generation, and setup automation for new or existing projects.

Topics

Topic	Description	Guide
contributing	Auto-generate CONTRIBUTING.md from project structure analysis	contributing.md

Quick Reference

Contributing (Auto-generate CONTRIBUTING.md)

/init contributing    # Analyze project and generate CONTRIBUTING.md

Key steps:

1. Detect project type (monorepo, single package, npm workspaces)
2. Analyze config files (package.json, .editorconfig, eslint, husky)
3. Detect directory structure and dependencies
4. Generate CONTRIBUTING.md with detected settings

What gets detected:

• Requirements: Node.js version, package manager from engines and packageManager
• Code Style: indent, EOL, charset from .editorconfig
• Lint Config: ESLint rules, Prettier settings
• Build Commands: scripts from package.json
• Commit Convention: Conventional Commits format with detected scopes
• Pre-commit Hooks: husky configuration
• Monorepo Structure: package dependency graph and build order

Detailed guide

Design Philosophy

• Detection over assumption: Only include sections for settings that actually exist in the project
• Language-aware: Match project language (English for open source, Korean for internal)
• Non-destructive: Always confirm before overwriting existing files