The Agent Skills Directory

[SAFE]: The skill implements automated validation via scripts/validate_skill.py, which uses static analysis (regex) to ensure skills follow naming conventions and do not include external Python dependencies. The script correctly avoids using unsafe functions like eval or exec and operates entirely within the Python standard library.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and validate external skill files. This creates a surface for indirect prompt injection where a malicious file could attempt to influence the agent's behavior during the review process. However, the skill includes explicit safety instructions to treat scripts as code and maintain scoped execution, and the validator script performs only regex-based parsing rather than execution.
[SAFE]: The documentation and rule priorities (Design-first, YAML rules, Folder structure) focus on architectural integrity and security best practices, explicitly prohibiting the inclusion of malware, credentials, or data exfiltration patterns.

skill-architect