The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The scripts/analyze_codebase.py utility contains regex patterns and logic designed to identify sensitive files such as .env, *.pem, credentials.json, and .aws/ directories. This functionality is intended to help users automatically populate .claudeignore files to prevent AI agents from accessing secrets, aligned with security best practices for AI onboarding.
[EXTERNAL_DOWNLOADS]: The assets/skill-downloader sub-skill and its associated Python scripts (download_skill.py, download_from_github.py, download_from_archive.py) enable the downloading of external code from user-supplied GitHub repositories and compressed archive URLs. While this facilitates project extensibility, it relies on the user or agent to ensure the trustworthiness of the source.
[COMMAND_EXECUTION]: The skill's bundled scripts utilize subprocess.run to perform legitimate development tasks, such as cloning git repositories (git clone, git sparse-checkout) and analyzing commit history (git log). Additionally, the init_skill.py script uses chmod to set execution permissions on newly created templates.
[METADATA_POISONING]: The documentation for the skill-downloader (assets/skill-downloader/SKILL.md) claims that all download methods validate that 'No malicious content patterns detected.' However, the underlying implementation only validates YAML frontmatter structure and does not perform any actual malicious content scanning. This represents a deceptive claim regarding the skill's security features.
[DYNAMIC_EXECUTION]: The skill provides documentation and templates in references/commands-patterns.md and references/hooks-patterns.md for using dynamic shell command execution (via the ! prefix) and lifecycle hooks. These patterns allow for automation such as code formatting and pre-tool validation within the agent's environment.

legacy-to-ai-ready