The Agent Skills Directory

[SAFE]: The skill implements rigorous input validation for agent and plugin names using the regex ^[a-z0-9]+(-[a-z0-9]+)*$. It explicitly rejects directory traversal attempts (..), absolute paths, and shell metacharacters, ensuring that file creation is restricted to the intended <appDataDir>\config\plugins\ scope.
[SAFE]: The skill follows the principle of least privilege by defaulting generated agents to read-only tools (Read, Grep, Glob) and cautioning against granting powerful tools like Bash unless explicitly requested and necessary for the task.
[SAFE]: The generated agent templates include a mandatory "Prompt Defense Baseline." This section instructs subagents to resist role-play attacks, prevent credential exposure, and treat external data as untrusted, which helps harden the security posture of the subagents created by the user.

agent-creator