The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script (meta-edit.py) uses subprocess.run to execute a companion validation script (meta-validate.py) if it is found in a sibling directory. The execution is handled safely by passing arguments as a list and avoiding the use of a shell.
[SAFE]: The skill implements security best practices by including dedicated XML escaping functions (esc_xml in Python and Esc-Xml in PowerShell). These functions ensure that user-provided strings for names, synonyms, and values are properly sanitized before being injected into XML structures, preventing XML injection attacks.
[DATA_EXFILTRATION]: Analysis of the source code confirms that the skill only interacts with local files provided via the ObjectPath or DefinitionFile arguments. There are no network calls or patterns suggesting unauthorized data transmission.
[PROMPT_INJECTION]: The instructional content in SKILL.md and associated documentation files focuses strictly on the syntax and usage of the editing tool. No patterns of behavioral override, safety bypass, or instruction disregard were detected.

meta-edit