The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to execute a local validation script (validate-skills.sh) to ensure skill metadata follows the required format. This script further utilizes standard development tools including bash, awk, python3, and npx to perform its checks.
[INDIRECT_PROMPT_INJECTION]: The validation script processes SKILL.md files within the repository. It specifically targets YAML frontmatter for structure and length checks. It employs yaml.safe_load within a Python sub-process, which is a secure practice for parsing untrusted YAML data to prevent code execution during the parsing phase.
Ingestion points: Reads files located at .claude/skills/*/SKILL.md.
Boundary markers: Explicitly uses --- YAML delimiters and awk to isolate the frontmatter.
Capability inventory: The script performs read-only validation and shell output; the instructions provide guidance on repository management.
Sanitization: Implements yaml.safe_load to prevent deserialization attacks.
[DYNAMIC_EXECUTION]: The validation script uses python3 -c to run a short validation routine. This is a standard and safe method for integrating logic within shell scripts for specific formatting checks.

skill-best-practices