The Agent Skills Directory

[SAFE]: The skill operates as a local static analysis tool for YAML files. The core logic in scripts/verify_ha_yaml_dry.py focuses on fingerprinting and comparing YAML blocks (triggers, conditions, actions) to detect duplication. It does not perform network operations or access sensitive system files like SSH keys or cloud credentials.
[COMMAND_EXECUTION]: The skill includes shell command examples in SKILL.md for running the Python verifier script. These are standard developer workflow commands targeting the provided local script and user-specified configuration directories. No suspicious or hidden command execution patterns were found.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs read-only analysis of Home Assistant YAML files. There are no patterns suggesting data exfiltration or the transmission of configuration data to external servers. The instructions explicitly recommend a 'read-only' safety pass for entity references and require manual confirmation for any destructive actions.
[PROMPT_INJECTION]: The instructions in SKILL.md are well-structured for guiding an agent through a linting workflow. While it uses 'Mandatory' and 'Critical' language, these are used appropriately to define the tool's resolution policy (enforcing DRY principles) rather than attempting to bypass safety filters or override the agent's core instructions.
[DYNAMIC_EXECUTION]: The scripts/verify_ha_yaml_dry.py script uses yaml.SafeLoader for parsing, which is a best practice for preventing arbitrary code execution during YAML deserialization. It also implements a custom constructor to handle unknown YAML tags (like !secret or !include) as opaque strings, further neutralizing potential injection risks from malicious YAML content.

homeassistant-yaml-dry-verifier