The Agent Skills Directory

[SAFE]: The primary instructions in SKILL.md and reference files provide best practices and workflows for agent skill development. The content is instructional and does not contain malicious prompt injections or bypass attempts.
[COMMAND_EXECUTION]: The skill includes internal tooling that utilizes subprocess.run and subprocess.Popen for tasks such as running the claude agent for trigger evaluations (scripts/eval_triggering.py) and executing the local validator script (scripts/hook_report_skill_tokens.py). These executions are scoped to the skill's directory and are required for its intended use as a development aid.
[EXTERNAL_DOWNLOADS]: Python scripts within the skill (validate_skill.py, render_report.py) declare dependencies on pyyaml and skills-ref (sourced from the agentskills GitHub repository). These downloads occur during the execution of the validation tools and are necessary for checking skill compliance with the platform standards.
[OBFUSCATION]: Static analysis signals for steganographic Unicode characters in tests/test_validate_skill.py were identified as false positives. These characters (such as \u00a0 and \u200b) are used within unit tests specifically designed to verify that the validate_skill.py detector correctly identifies such characters in other skills.
[DYNAMIC_CONTEXT_INJECTION]: The skill implements a PostToolUse hook to automatically generate token reports after a user edits a skill file. This hook is a standard implementation of a post-action callback and does not utilize the !command`` syntax for at-load-time execution.

skill-creator-primer