The Agent Skills Directory

[SAFE]: The skill serves as a development tool for managing agent skills. All detected operations are local to the file system and perform expected tasks such as file reading, directory creation, and zip archiving.
[COMMAND_EXECUTION]: The skill provides scripts and instructions for running local Node.js utilities (analyze-skill.mjs, init-skill.mjs, package-skill.mjs). These utilities are used for project maintenance (scaffolding, validation) and do not execute untrusted external commands.
[PRIVILEGE_ESC_ANALYSIS]: The init-skill.mjs script uses chmodSync to set permissions to 0755 (rwxr-xr-x) for newly created scripts. This is standard behavior for ensuring scripts are executable and does not constitute a privilege escalation risk.
[DATA_EXPOSURE_ANALYSIS]: No hardcoded credentials, sensitive file path access (outside of defined skill directories), or network operations were detected in the provided scripts or reference materials.
[INDIRECT_PROMPT_INJECTION]: While the skill processes other skill files (Category 8), it does so for static analysis and validation. The instructions encourage human-in-the-loop verification and do not provide an automated surface for executing instructions embedded in analyzed data.
[OBFUSCATION_ANALYSIS]: The generated library _lib/asset-tools.mjs was reviewed for hidden behavior. It contains standard implementations for YAML parsing, CRC32 calculation, and zip creation (Deflate) with no evidence of malicious obfuscation.

skill-creator