The Agent Skills Directory

[SAFE]: The skill follows security best practices by isolating its operations and restricting the execution of analyzed content.
The skill explicitly prohibits executing code, installing dependencies, or running scripts from analyzed repositories, mitigating remote code execution risks.
It utilizes temporary directories for cloning and output generation to prevent interference with the user's workspace or existing projects.
It implements strict credential management, relying on existing local git configurations and explicitly forbidding the request or publication of tokens.
The output format (HTML) is strictly regulated to be self-contained with no external network dependencies, preventing data exfiltration from the rendered page.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party codebases, which represents a potential attack surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through git cloning and file reading operations defined in Phase 2 and Phase 3 of SKILL.md.
Boundary markers: The SKILL.md file contains a dedicated 'Security boundary' section that explicitly instructs the agent to treat all repository content as untrusted data and never as instructions.
Capability inventory: The skill is capable of file system access (read/write in temporary directories) and executing git commands for cloning.
Sanitization: All external content is HTML-escaped before being included in the generated page to prevent XSS, and the page is prohibited from making any network requests.

awesome-code-explainer