The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected during the analysis of the skill's instructions and source code.
[COMMAND_EXECUTION]: The skill uses the uv tool to execute its internal Python logic for processing text. This is a controlled execution environment for the skill's own code and does not allow for arbitrary command injection.
[DATA_EXFILTRATION]: The skill does not contain any network-reaching code (e.g., requests, urllib, or shell-based network tools). It only reads from user-specified local directories and optionally writes a JSON report to a local path.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown data but is not vulnerable to indirect injection attacks because it only extracts and reports statistical metadata (n-gram frequencies and counts). The raw content of the files is not re-interpolated as instructions for the agent.

phrase-audit