The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (init_skill.py, validate_skill.py) intended to be executed locally by the agent to automate file system tasks and validation. It also recommends using shell commands like source ~/.zshrc to maintain environment consistency when running skill-specific scripts.
[INDIRECT_PROMPT_INJECTION]: The validate_skill.py script ingests and processes external skill files to perform validation. While this creates an attack surface for instructions embedded in validated files, the script uses static regex patterns to identify issues rather than executing instructions from the content.
Ingestion points: validate_skill.py reads content from files within a user-specified directory during the validation process.
Boundary markers: The validator treates file content as data for regex matching and does not employ specific delimiters.
Capability inventory: The skill utilizes Bash, Read, Write, and Edit permissions as defined in SKILL.md; init_skill.py creates and modifies directory structures and files.
Sanitization: The validator implements regex-based checks to flag suspicious patterns, such as hardcoded credentials or excessive file lengths, providing a layer of security review.
[SAFE]: The skill provides clear guidance on secure credential management, instructing users to store secrets in platform-specific configuration files and access them via environment variables. All external references point to trusted organizations and official specifications.

building-skills