The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The bundled script scripts/count_tokens.py utilizes standard, versioned Python packages (google-genai, google-auth, pyyaml) for its functionality.
[COMMAND_EXECUTION]: The documentation provides instructions for executing the bundled auditing script via uv run, which is an expected part of the skill's developer-focused workflow.
[DATA_EXFILTRATION]: The skill's token auditing script transmits file contents to the official Google Gemini API for processing. This is a legitimate use of a well-known service for the purpose of token counting.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data when auditing other skill s. Evidence chain: 1. Ingestion point: scripts/count_tokens.py reads file conten t. 2. Boundary markers: Not used for plain text, but frontmatter is parsed separately. 3. Capability inventory: Includes file reading and network calls to Gemini API. 4. Sanitization: Uses yaml.safe_load to prevent code execution during YAML parsing. The risk is mitigated as the script performs non-generative analysis rather than incorporating the untruted content into the agent's instructions.

skill-optimizer