The Agent Skills Directory

[SAFE]: The skill acts as a technical knowledge base and development toolkit for Claude Code, containing reference documentation and helper scripts.
[COMMAND_EXECUTION]: The skill provides various bash scripts (git-commit.sh, gh-pr.sh, gh-issue.sh, gh-project.sh, skills-sync.sh) for automating repository workflows. These scripts demonstrate secure coding practices:
Use of set -euo pipefail to ensure scripts terminate on errors.
Proper variable quoting to prevent command injection vulnerabilities.
Inclusion of a check_no_secrets function in git-commit.sh to prevent accidental staging of sensitive files like .env, .pem, or .key files.
Explicit warnings in scripts like gh-issue.sh regarding the necessity of input sanitization before processing user-supplied data.
[SAFE]: The documentation files (reference/*.md) provide summaries of Claude Code specifications. While they document powerful features such as hooks and dynamic context injection (shell execution within markdown), they do so for educational purposes and do not contain malicious implementations.
[SAFE]: The sample files (sample/) provide templates for skills, agents, and rules that adhere to established security guidelines. A sample instruction mentions GIT_SSL_NO_VERIFY=1, which is correctly presented as a requirement specifically for sandbox environments and refers to appropriate internal documentation.

claude-code-reference