The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The package_skill.py script executes a local validation script (quick_validate.py) via subprocess.run. The command is constructed safely using a list of arguments and a locally resolved path to the script, which prevents shell injection.
[DYNAMIC_EXECUTION] (SAFE): The quick_validate.py script uses yaml.safe_load() to parse the frontmatter of SKILL.md files. This is a secure method for processing YAML that prevents execution of arbitrary code embedded in the data.
[EXTERNAL_DOWNLOADS] (SAFE): No network operations, external downloads, or exfiltration patterns were identified in any of the files. Scripts operate entirely on the local file system.
[PROMPT_INJECTION] (SAFE): The documentation files (output-patterns.md, workflows.md) contain examples of formatting and workflow instructions. These are pedagogical examples for developers and do not contain malicious injection payloads targeting the agent or analyzer.

skill-creator