The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/fetch_refound_skills.py script performs network requests to refoundai.com to download skill definitions. While this matches the skill's stated purpose, it involves retrieving and storing content from an external, untrusted source.
[COMMAND_EXECUTION]: The script scripts/package_skillpack.py uses subprocess.call to execute the local scripts/lint_skillpack.py validator. This execution uses the current Python interpreter and a path relative to the script location to ensure the linter is run before packaging.
[PROMPT_INJECTION]: As a meta-skill that transforms external data into instructions, the skill is susceptible to indirect prompt injection. Maliciously crafted content from the source domain could result in the generation of skill packs with harmful instructions. The skill includes a SECURITY_GUIDE.md which provides mitigation advice for authors, such as using delimiters and least-privilege principles.

lenny-skillpack-creator