The Agent Skills Directory

[COMMAND_EXECUTION]: The init_skill.py and package_skill.py scripts execute local file system operations to create directories and write files. These actions are standard utility functions for skill management and do not involve executing external commands or scripts.\n- [PROMPT_INJECTION]: An assessment of the indirect prompt injection surface (Category 8) confirms that while the skill ingests user input (skill names and paths via command-line arguments), this data is validated against strict naming conventions and used only for local file management. Ingestion points: Command-line arguments in init_skill.py and package_skill.py. Boundary markers: None. Capability inventory: Local file system read/write and directory creation. Sanitization: quick_validate.py enforces hyphen-case naming with a strict alphanumeric regex.\n- [SAFE]: The init_skill.py script generates a template Python script for scaffolding purposes; this is a static file-writing process and does not involve runtime code evaluation or the use of unsafe functions like eval() or exec().\n- [SAFE]: The skill implements security best practices by using yaml.safe_load in quick_validate.py to parse metadata, which prevents potential code execution attacks via YAML deserialization.

skill-creator