The Agent Skills Directory

[SAFE]: The skill implements significant defensive logic to ensure safe operations.
check_dir_trusted validates ownership (root or current user) and requires sticky bits on all parent directories of the temporary workspace to prevent hijacking.
assert_no_symlink_components prevents path traversal by verifying that no component of a resolved path is a symbolic link.
[COMMAND_EXECUTION]: The skill uses standard CLI tools (git, gh, jq) and its own validated shell script (scripts/skills-contribute.sh) for its primary functionality.
The SKILL_NAME argument is strictly validated against a kebab-case regex (^[a-z][a-z0-9-]+$) before use in commands.
[EXTERNAL_DOWNLOADS]: The skill performs repository cloning using gh repo clone.
Repository targets are strictly limited to the Fandhe-AI organization on GitHub using a complete-match regex (^Fandhe-AI/[A-Za-z0-9._-]+$) applied to normalized repository slugs.
[SAFE]: The skill includes a dedicated safety check (assert_local_skill_clean) that flags the presence of ignored files (like .env) or uncommitted changes.
This prevents the accidental exfiltration of secrets or local configuration to upstream repositories during the contribution process.

contribute-skill