The Agent Skills Directory

Indirect Prompt Injection (SAFE): The skill functions as a template generator for other skills based on user input. This ingestion surface is secured by the included validation script (quick_validate.py), which enforces strict naming schemas and sanitizes description text (e.g., blocking angle brackets) to prevent the generation of malicious artifacts.
Dynamic Execution (SAFE): The scripts/quick_validate.py utility correctly implements yaml.safe_load() for parsing skill metadata, which is the standard defense against unsafe deserialization and arbitrary code execution in YAML processing.
Command Execution (INFO): The skill's configuration includes permission to run a local initialization script (init_skill.py). While this specific script was not provided in the source bundle, the allowed-tools definition is restricted to a specific local path, which is appropriate for its stated purpose of skill creation.

skill-creator