The Agent Skills Directory

[SAFE]: The skill is a developer utility designed to improve the quality and security of AI agent skills through guided creation and automated validation.
[COMMAND_EXECUTION]: The scripts/security_scan.py script utilizes subprocess.run to invoke the gitleaks binary. This execution is performed safely by passing arguments as a list and avoiding shell interpolation, which mitigates command injection risks.
[EXTERNAL_DOWNLOADS]: The documentation and scripts provide links and instructions for downloading gitleaks from its official GitHub repository and reference Anthropic's platform documentation. These are well-known and reputable sources for developer tools.
[INDIRECT_PROMPT_INJECTION]: The validation and scanning scripts ingest content from user-provided skill directories. While this constitutes an input surface for untrusted data, the tool's purpose is to detect and report security issues within that data, acting as a defensive measure rather than a vulnerability.
[PRIVILEGE_ESCALATION]: The scripts/init_skill.py utility applies executable permissions (0o755) to newly created template scripts. This is a standard administrative operation for initializing developer tools and does not constitute an unauthorized privilege escalation.
[DYNAMIC_EXECUTION]: The skill uses standard Python libraries for file manipulation and packaging. The AST analysis flag for subprocess.run was evaluated and found to be a benign and secure implementation for running an external security scanner.

skill-creator