The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/new-python-project.py and scripts/audit-python-project.py scripts utilize subprocess.run to execute Git commands, such as git init and git ls-files. These calls are implemented using list-based arguments without a shell, which is a secure practice that prevents command injection.
[EXTERNAL_DOWNLOADS]: The skill documentation (SKILL.md) and project templates (AGENTS.md.tmpl) recommend installing companion skills using npx skills@latest add daviddwlee84/agent-skills/skills. This is a vendor-owned resource hosted on a well-known service (npm), intended to extend the project's capabilities.
[INDIRECT_PROMPT_INJECTION]: The audit-python-project.py script serves as a data ingestion surface by reading local project configuration files (like pyproject.toml) to provide scoring and migration plans.
Ingestion points: scripts/audit-python-project.py (reading pyproject.toml, setup.py, etc.).
Boundary markers: The script produces structured JSON or table output for agent consumption.
Capability inventory: The script is limited to read operations and local Git metadata checks.
Sanitization: Ingested data is parsed using the standard tomllib library, and the script is read-only.

python-project-best-practice