The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes a template generation utility (scripts/init_skill.py) that writes Python scripts and Markdown documentation to the filesystem based on user-provided skill names. This behavior is directly aligned with the skill's primary purpose as a project initializer and follows standard development patterns.
[REMOTE_CODE_EXECUTION]: Documentation files (e.g., references/plugin-marketplace-sources.md) describe the platform's ability to fetch and install plugins from external Git repositories such as GitHub and GitLab. These descriptions are informational and part of the distribution guidelines rather than active execution of untrusted remote code by the skill itself.
[INDIRECT_PROMPT_INJECTION]: The skill provides explicit guidance on preventing prompt injection in the instructions it generates. It includes a validation script (scripts/quick_validate.py) that proactively checks for and disallows the use of angle brackets in metadata descriptions to prevent accidental instruction leakage into system prompts.
[PRIVILEGE_ESCALATION]: The initialization script correctly sets executable permissions (0o755) for generated helper scripts. This is a standard requirement for CLI tools and scripts within the agent environment.
[CREDENTIALS_UNSAFE]: While documentation mentions environment variables such as GITHUB_TOKEN for authentication, it does so in the context of explaining standard security practices for managing private repository access, using generic placeholders rather than hardcoding sensitive information.

skill-creator