The Agent Skills Directory

[SAFE]: No security issues detected.\n- [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (scripts/scaffold.mjs) to generate new skill skeletons. This script is self-contained, using only standard Node.js built-in modules (fs, os, path), and performs local file system operations without requiring network access or elevated permissions.\n- [SAFE]: The generator script implements robust validation for the skill name input, ensuring it conforms to kebab-case alphanumeric patterns and a 64-character length limit. This validation prevents common injection attacks and path traversal when generating file structures.\n- [SAFE]: The skill's configuration and metadata (such as package.json) do not include any external dependencies or remote code execution patterns, maintaining a minimal security footprint.\n- [SAFE]: References to external Git repositories and NPM scopes are directed at the vendor's own verified infrastructure (acme-skunkworks), which is consistent with the skill's purpose as a meta-tool for the agent-skills ecosystem.

scaffold-new-skill