The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/scaffold.py to execute shell commands via subprocess.run. These commands interact with gh (GitHub CLI) to create repositories, set topics, and verify authentication, and git to initialize local clones. The execution uses safe argument lists and avoids shell=True.
[SAFE]: Implements comprehensive input validation for all user-supplied parameters (name, description, idea). It uses regular expressions to enforce kebab-case naming and filters for control characters in prose fields to prevent injection.
[SAFE]: The scaffolding logic protects against placeholder collision by scanning user input for the skill's own template tokens (e.g., {{TOKEN}}) and refusing to proceed if they are detected.
[SAFE]: Follows a secure-by-default posture by creating GitHub repositories as private and leaving the initial scaffolded content uncommitted. This ensures the user must review all generated files before they are persisted or shared.
[SAFE]: The project template includes security-focused components such as guard_bash.py, which acts as a PreToolUse hook to prevent high-risk operations like force-pushing to the main branch or bypassing quality gates during agent sessions.

create-skill-repo