The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/verify-commands.sh script executes shell commands extracted directly from AGENTS.md files using bash -c. While it employs a whitelist of 'safe' base commands (such as npm, make, curl, and python), the script does not sanitize the full command string. This allows for execution of malicious command chains, such as pipes to interpreters, if they are present in the documentation being analyzed. This behavior is associated with the skill's core purpose of verifying command accuracy but represents a significant security surface.
[EXTERNAL_DOWNLOADS]: Several scripts, including scripts/extract-github-settings.sh and scripts/extract-github-rulesets.sh, perform network requests to api.github.com via the GitHub CLI. These operations are restricted to retrieving repository metadata and target a well-known, trusted service, which is appropriate for the skill's stated intent.
[SAFE]: The skill includes numerous template and example files (e.g., references/examples/fastapi-app/.env.example). These files correctly use generic placeholders for sensitive data like database passwords and API keys, following industry-standard safety practices for example configurations.

agent-rules