The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses uv run to execute local Python scripts. The scripts declare standard dependencies, such as pyyaml (via PEP 723), which are fetched from official registries.
[COMMAND_EXECUTION]: The skill performs filesystem operations including directory creation (mkdir -p) and directory removal through the cleanup-legacy.py script. The cleanup script includes a safety verification step (--skills-dir) that ensures skill files are present in the global .claude/skills directory before deleting the local legacy copies.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by collecting user input and writing it to configuration files (config.yaml, config.user.yaml) that are intended for consumption by other AI agents. However, the skill implements privacy best practices by writing personal data exclusively to a .gitignore-intended file (config.user.yaml) and uses standard structured data formats (YAML/CSV) to prevent simple boundary escapes.
[SAFE]: The skill instructions provide clear guidance on resolving path tokens ({project-root}) and explicitly state that user-sensitive keys should not be stored in shared configuration files. The code and scripts are transparent, well-documented, and perform only the tasks described in the skill overview.

sample-module-setup