The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/init_skill.py generates Python code by inserting a user-provided skill name into a string template. The input is not sanitized before interpolation, which allows for arbitrary code injection into the generated example.py script if a malicious name is used.
[COMMAND_EXECUTION]: The skill provides tools that perform file system management, including creating directory structures, writing files to disk, and zipping directory contents. It also programmatically changes file permissions using chmod 0o755 to make scripts executable.
[PROMPT_INJECTION]: The skill has an indirect injection surface. Ingestion points: scripts/init_skill.py and scripts/package_skill.py (CLI arguments). Boundary markers: None. Capability inventory: File-write, directory creation, and permission modification in scripts/init_skill.py; file-read and archiving in scripts/package_skill.py. Sanitization: None for the skill_name input used in code generation.

skill-creator