The Agent Skills Directory

[CREDENTIALS_UNSAFE] (SAFE): The documentation contains templates for Azure SDK environment variables (e.g., AZURE_CLIENT_SECRET), but these are placeholders and no actual credentials are hardcoded.
[COMMAND_EXECUTION] (SAFE): The package_skill.py and quick_validate.py scripts perform standard filesystem operations like reading files and creating ZIP archives. They do not execute arbitrary shell commands or untrusted code.
[DATA_EXFILTRATION] (SAFE): No network requests or data transfer operations were found in the scripts or documentation.
[DYNAMIC_EXECUTION] (SAFE): The quick_validate.py script uses yaml.safe_load() to parse frontmatter, which is the secure method for handling YAML and prevents arbitrary code execution.
[INDIRECT_PROMPT_INJECTION] (LOW): The utility scripts ingest file paths as command-line arguments. While they validate for a SKILL.md file, an agent using these tools should ensure the input paths are restricted to the skill's workspace to prevent zipping unintended directories.

skill-creator