The Agent Skills Directory

[COMMAND_EXECUTION]: The install_skill.py script executes a local Python utility (scan_registry.py) via the subprocess.run function. This is a functional requirement to update the internal skill registry. The execution is strictly scoped to a hardcoded path within the application's local directory.
[DATA_EXPOSURE]: The validate_skill.py script includes a proactive security mechanism that scans for and prevents the installation of files matching known sensitive patterns, such as .env, credentials.json, *.key, and *.pem. This minimizes the risk of accidental secret exposure within the local ecosystem.
[EXTERNAL_DOWNLOADS]: Static analysis of all script files confirms the absence of any network-related operations. The tool does not perform HTTP requests, remote downloads, or external API calls.
[PROMPT_INJECTION]: The instructional content in SKILL.md is limited to operational guidance for skill deployment and management. No patterns associated with bypassing safety guidelines, ignoring system prompts, or role-play-based jailbreaks were identified.

skill-installer