The Agent Skills Directory

[SAFE]: The skill provides developer templates and documentation for building Claude Code plugins. It includes a static analysis script (scripts/audit-mod.ts) to help users evaluate the cost and reach of their own mods.- [INDIRECT_PROMPT_INJECTION]: Several templates (e.g., next-steps-supervisor, quiz-after) utilize the model.fork capability to process conversation transcripts. While this introduces an attack surface where the model could be influenced by previous conversation turns, the templates implement defensive JSON parsing and clear instructional boundaries to mitigate risk. This behavior is consistent with the intended functionality of the templates.- [COMMAND_EXECUTION]: The scripts/audit-mod.ts script uses standard Node.js file system APIs to perform static analysis. This is a standalone utility script meant for manual execution by the developer and does not involve arbitrary command execution of untrusted input.- [DATA_EXPOSURE]: The templates use standard platform features like $.state and $.store for session persistence. No evidence of unauthorized data exfiltration or hardcoded credentials was found.

modsmith