The Agent Skills Directory

[CODE_ANALYSIS]: The skill performs static analysis of other Python and Markdown files. It uses the ast module to inspect code structure (complexity, exception patterns, etc.) and yaml.SafeLoader to parse metadata. This is a safe method of auditing content without execution.
[DATA_EXPOSURE]: The skill reads local files for auditing purposes. However, it implements a defensive I/O layer in scripts/source_io.py which enforces path isolation (relative to a chosen root), refuses to follow symbolic links, and limits file sizes to 2 MiB to prevent resource exhaustion or unauthorized access to system files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (source code and metadata from other skills). It mitigates injection risks by sanitizing all data before including it in generated audit reports. The report_generator.py script uses an inert() function to HTML-escape content and backslash-escape Markdown control characters.
[COMMAND_EXECUTION]: All analyzed scripts perform local data processing and database operations (SQLite). There are no calls to subprocess, os.system, eval, or exec. The tool does not perform network operations.
[PRIVILEGE_ESCALATION]: The skill uses a private state directory (either defined by SKILL_SENTINEL_STATE_DIR or defaulting to standard XDG paths) and explicitly enforces 0700 (user-only) permissions on its database and report folders.
[METADATA_POISONING]: The skill's metadata accurately reflects its purpose as a governance and auditing tool. The tools listed in the frontmatter (claude-code, antigravity, etc.) are typical for its development-oriented use case and are not invoked by the skill itself.

skill-sentinel