The Agent Skills Directory

[PROMPT_INJECTION]: No evidence of prompt injection or safety filter bypass attempts. The instructions focus on structured testing and reporting in both English and Korean.
[DATA_EXFILTRATION]: No network operations or sensitive data access detected. The provided scripts (validate-skill.mjs, validate-skills-corpus.mjs) use standard filesystem modules for local static analysis only.
[COMMAND_EXECUTION]: The skill includes two Node.js scripts. Analysis confirms they use node:fs and node:path for file validation tasks (checking for missing files, YAML frontmatter, and code fence balance). There are no calls to eval(), exec(), or other dynamic execution sinks.
[OBFUSCATION]: No obfuscated strings, Base64-encoded commands, or hidden characters were detected in any of the 12 files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze other skill files. While this presents a theoretical attack surface for indirect injection, the provided scripts perform strictly static regex-based and structural checks, minimizing risk. The workflow documentation explicitly includes a safety-gap classification to encourage security-conscious testing.
[EXTERNAL_DOWNLOADS]: No remote dependencies or external script downloads are utilized. The scripts are standalone Node.js utilities requiring no third-party packages.

skill-tester