The Agent Skills Directory

SAFE (INFO): No security issues were identified across the provided files. The scripts use defensive programming techniques:
Input Validation: quick_validate.py implements strict schema and regex validation for skill metadata.
Safe Parsing: quick_validate.py correctly utilizes yaml.safe_load() to prevent arbitrary code execution during YAML deserialization.
Path Handling: package_skill.py uses pathlib for secure path resolution and relative mapping when creating archives.
Category 8: Indirect Prompt Injection (LOW): The validation script processes external SKILL.md files (untrusted data). However, it only performs structural validation and safe parsing without executing the content or using it to drive high-privilege decisions, resulting in a negligible risk profile.

skill-creator