The Agent Skills Directory

[COMMAND_EXECUTION]: The skill scripts (new-python-project.py, audit-python-project.py, and the generated sync_agent_docs.py) use the Python subprocess module to execute local system commands. These commands are limited to project-related operations such as initializing a Git repository, listing tracked files, and running the generated CLI with a --help flag for documentation purposes. These are safe, functional uses of command execution.
[EXTERNAL_DOWNLOADS]: Several scripts utilize the PEP 723 inline script metadata to declare dependencies (e.g., tyro, loguru, pydantic-settings). These dependencies are automatically managed and downloaded by the uv tool from the standard PyPI registry. These are well-known, safe packages.
[DATA_EXPOSURE]: The skill explicitly includes best practices for preventing data exposure. The audit-python-project.py script contains a check to detect if .env files (which typically contain secrets) are being tracked by Git. Furthermore, the logging configuration in _log.py.tmpl explicitly sets diagnose=False to prevent the accidental leakage of local variables or credentials in error tracebacks.
[INDIRECT_PROMPT_INJECTION]: The audit-python-project.py script processes external project files (like pyproject.toml). The logic is restricted to parsing structured data (TOML) and applying regex patterns to verify configuration. It does not execute instructions found within the audited data, providing a safe boundary between processed content and the agent's logic.

python-project-best-practice