The Agent Skills Directory

[SAFE]: The script scripts/skill-doctor.py implements safe YAML parsing using yaml.safe_load, preventing arbitrary code execution through malicious frontmatter content.
[COMMAND_EXECUTION]: The unit test suite in scripts/test_skill_doctor.py uses subprocess.run to execute the audit script for verification. This is confined to the test environment and represents standard software development practice.
[SAFE]: The skill reads file content from local directories specifically provided by the user to perform its audit. No patterns indicating data exfiltration or access to sensitive system paths (e.g., credentials or SSH keys) were identified.
[SAFE]: File system modifications are limited to the creation or update of specific metadata files (agents/openai.yaml) and only occur when the user explicitly triggers the --fix-safe functionality.

skill-doctor