The Agent Skills Directory

[SAFE]: The skill is primarily instructional, offering guidance on API architecture, authentication, and security testing (OWASP Top 10). It contains no hidden instructions or obfuscated content.
[COMMAND_EXECUTION]: The provided script scripts/api_validator.py is a utility for the agent to audit local project code. It uses the pathlib and re modules to scan files for pattern-based indicators of good API design (e.g., presence of error handling, status codes, and validation logic). The script operates locally, does not perform network operations, and includes a limit on the number of files processed (15) to manage resource usage.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it reads local project files for validation. However, the processing is limited to static regex matching. The risk is minimal as the script does not execute the content of the files it reads, nor does it interpolate untrusted data into instructions that would override agent behavior.
[CREDENTIALS_UNSAFE]: The auth.md and security-testing.md files provide security advice regarding JWT and session management. No hardcoded credentials or secrets are present in the skill files.

api-patterns