The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a suite of local Python scripts (init_skill.py, quick_validate.py, package_skill.py) meant to be executed by the agent to automate skill creation. These scripts operate locally within the user's workspace and do not perform network requests or download remote content.
[DATA_EXPOSURE]: The packaging script (package_skill.py) includes a robust should_include function that explicitly filters out sensitive files such as .env files, private keys (.pem, .key), and development artifacts (.git, node_modules, __pycache__) to prevent accidental leakage of secrets in packaged skills.
[INDIRECT_PROMPT_INJECTION]: The initializer script (init_skill.py) implements strict validation on user-provided skill names using a regular expression that permits only lowercase alphanumeric characters and hyphens. This serves as a defense against command injection and path traversal when user-provided strings are interpolated into file paths and templates.

skill-creator