The Agent Skills Directory

[SAFE]: The skill operates within a structured workflow for API refactoring, utilizing standard agent tools for file analysis and modification without requesting unnecessary privileges.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external backend code. However, this risk is mitigated by clear instructions that separate analysis from execution and mandate the preservation of existing contracts and security logic.
[SAFE]: The scripts/profile_store.py utility manages local configuration in a secure manner. It uses atomic file operations and sets restrictive file permissions (0o600) to protect user data. It also includes a robust validation mechanism that blocks the storage of sensitive keys (e.g., tokens, secrets, passwords) within the profile records.
[EXTERNAL_DOWNLOADS]: The skill documentation mentions installation via a platform-specific package manager (npx skills). This is a standard setup procedure and does not involve risky runtime remote code execution.
[SAFE]: The scripts/validate_skill.py tool uses yaml.safe_load() to parse YAML content, effectively preventing potential insecure deserialization attacks during the validation process.

lov-refactor-api