The Agent Skills Directory

[SAFE]: The skill instructions and scripts do not contain malicious patterns or security risks. The system is designed with a strong defensive posture, including a 'Mandatory session gate' and detailed references for safety, referral, and scope boundaries.
[COMMAND_EXECUTION]: The test suite (tests/test_validate_capabilities.py) utilizes subprocess.run to verify the manifest validator script. This usage is safe as it is confined to testing, avoids shell execution, and uses controlled paths.
[DYNAMIC_EXECUTION]: The tests use importlib.util to load the validation script (scripts/validate-capabilities.py) dynamically. This is a standard practice for Python testing and does not incorporate untrusted external input.
[INDIRECT_PROMPT_INJECTION]: The skill processes external configuration via a JSON manifest. The potential attack surface is well-mitigated by the validate-capabilities.py script, which enforces a strict schema, type checking, and regex validation for all fields before the data can influence agent behavior.

life-coach