The Agent Skills Directory

[SAFE]: The Python script scripts/mdq.py implements several security-conscious measures:
It uses yaml.SafeLoader (via the DuplicateKeyLoader subclass) to parse YAML profiles, which prevents arbitrary code execution during deserialization.
It explicitly disables YAML aliases to prevent expansion-based resource exhaustion attacks.
It enforces REGEX_TIMEOUT_SECONDS (0.05s) and MAX_PATTERN_LENGTH on user-supplied regex patterns to protect against Regular Expression Denial of Service (ReDoS) attacks.
[DATA_EXFILTRATION]: The script includes functionality to write sidecar index files. It implements robust path validation in the index_path function, checking that paths are relative, do not escape the document's directory tree, and are not symlinks, which effectively prevents path traversal vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill uses uv to manage its Python dependencies (markdown-it-py, PyYAML, regex) from the official PyPI registry. These are well-known and standard libraries for the skill's purpose.
[COMMAND_EXECUTION]: The test file tests/test_mdq.py uses subprocess.run to execute the skill's own script for testing purposes. This is standard practice for unit tests and occurs within a controlled test environment.

make-markdown-queryable