The Agent Skills Directory

[SAFE]: The skill implements a secure project-profile resolution system in scripts/resolve.py.template. This system uses deterministic hashing (hashlib.sha256) to track instruction versions and strictly enforces path containment using pathlib to prevent directory traversal attacks.
[SAFE]: The validation suite (scripts/quick_validate.py) leverages Python's Abstract Syntax Tree (AST) to statically analyze scripts and ensure they do not contain hardcoded project-specific branches, promoting secure and reusable code patterns.
[SAFE]: External dependencies are restricted to well-known libraries (specifically PyYAML) and are managed via standard PEP 723 inline script metadata, ensuring safe and isolated execution through the uv package manager.
[COMMAND_EXECUTION]: The skill uses subprocess.run within its integration tests (scripts/tests/test_init_skill.py) to verify the functionality of its initialization and resolution scripts. These operations are limited to executing the skill's own local scripts using the current Python interpreter and do not process untrusted external input.

skillcraft