The Agent Skills Directory

[SAFE]: The skill provides legitimate utility for developers creating AI agent extensions by providing documentation and scaffolding tools.
[COMMAND_EXECUTION]: The skill includes Python scripts (init_skill.py, package_skill.py) intended for local execution to manage the skill lifecycle. These scripts utilize standard library modules and do not contain any malicious logic or hidden commands.
[PRIVILEGE_ESCALATION]: In scripts/init_skill.py, the script sets executable permissions (0o755) on a generated template script. This is a standard and expected operation for a developer scaffolding tool.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing user-defined metadata in SKILL.md. It mitigates risks by using yaml.safe_load for parsing and performing regex-based validation on fields like name and description to ensure they meet length and character constraints.
Ingestion points: Reads user-provided SKILL.md for validation.
Boundary markers: Explicit field validation and YAML schema enforcement in quick_validate.py.
Capability inventory: File system writes (init_skill.py) and zip packaging (package_skill.py).
Sanitization: Employs yaml.safe_load and strict regex checks on the name field to prevent path traversal or injection.

skill-creator