The Agent Skills Directory

[SAFE]: The skill's primary function is to provide documentation and local developer tools. No malicious patterns, obfuscation, or data exposure vectors were identified through the analysis of all scripts and reference files.
[COMMAND_EXECUTION]: The skill contains utility scripts (init_skill.ts, package_skill.ts, quick_validate.ts) that perform routine file system operations such as creating directories, writing files, and packaging archives. These are standard operations for the stated purpose of the skill as a development toolkit and do not involve the execution of arbitrary shell commands or untrusted binaries.
[EXTERNAL_DOWNLOADS]: The scripts reference legitimate, well-known third-party libraries including archiver and js-yaml from the official NPM registry for archive creation and YAML parsing. These are trusted dependencies commonly used for these tasks.
[PROMPT_INJECTION]: The utility scripts ingest user-provided skill names and directory paths to generate files. While this creates a potential surface for indirect injection, it is managed through local execution.
Ingestion points: Command-line arguments skill-name and targetPath in scripts/init_skill.ts and scripts/package_skill.ts.
Boundary markers: Absent; the scripts do not use specific delimiters to isolate user-provided strings within the generated file content.
Capability inventory: File system write operations (fs.mkdir, fs.writeFile) and file permission updates (fs.chmod) in scripts/init_skill.ts and scripts/package_skill.ts.
Sanitization: Absent; command-line inputs are used in path.resolve without rigorous validation, which is common for local utility scripts but represents a theoretical path manipulation surface.

skill-creator