The Agent Skills Directory

[COMMAND_EXECUTION] (LOW): The package_skill.py script uses standard library functions (zipfile, pathlib) to create archive files. While it executes logic based on command-line arguments, it does not invoke arbitrary system shells or execute untrusted code.
[DATA_EXPOSURE] (SAFE): The scripts operate on local file paths provided by the user and do not access sensitive system directories or credentials.
[INDIRECT_PROMPT_INJECTION] (LOW): The quick_validate.py script parses YAML frontmatter from SKILL.md using yaml.safe_load(). This is the recommended secure practice to prevent arbitrary object instantiation during parsing.

skill-creator