The Agent Skills Directory

[COMMAND_EXECUTION]: The main workflow in SKILL.md requires the agent to execute local Python scripts (scripts/init_skill.py, scripts/quick_validate.py, and scripts/package_skill.py) to perform its primary functions.\n- [PRIVILEGE_ESCALATION]: The scaffolding script scripts/init_skill.py automatically sets executable permissions (0o755) on the example.py script it creates. While this is typical for development tools, it involves dynamic permission modification.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user input to generate new skill files, creating a potential injection surface.\n
Ingestion points: The scripts/init_skill.py script takes a user-supplied <skill-name> and interpolates it directly into the generated SKILL.md and script templates.\n
Boundary markers: The generated templates do not include markers or instructions to delimit or ignore potentially malicious content within the interpolated fields.\n
Capability inventory: The skill utilizes file system writes and script execution (scripts/init_skill.py, scripts/package_skill.py).\n
Sanitization: The scaffolding script does not sanitize the skill name before interpolation, although scripts/quick_validate.py provides secondary validation that checks for angle brackets in descriptions and enforces kebab-case naming.

skill-creator