The Agent Skills Directory

[SAFE]: The skill performs repository analysis by executing git log via Python's subprocess module. All subprocess calls in scripts/build_ownership_map.py, scripts/community_maintainers.py, and scripts/run_ownership_map.py use argument lists rather than shell strings, preventing command injection vulnerabilities when processing repository paths or git history.
[SAFE]: No network operations or data exfiltration patterns were found. The skill operates entirely on the local file system, reading git metadata and writing CSV/JSON analysis results to a user-defined output directory.
[SAFE]: The skill requires the networkx library for graph analysis. This is a well-known, legitimate package and its use here is consistent with the skill's stated purpose of building bipartite and co-change graphs.
[INDIRECT_PROMPT_INJECTION]: The skill processes git history, which is an untrusted data source. Ingestion points include scripts/build_ownership_map.py and scripts/community_maintainers.py via git log. The skill uses a custom --- delimiter for parsing and maintains safety by using subprocess.Popen with argument lists, preventing shell injection from commit metadata or file paths.

security-ownership-map