The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill employs a Python helper script (scripts/scaffold-skill.py) to generate new skill folder structures and files from templates at runtime.
Evidence: The script uses string interpolation (.format()) to populate templates for SKILL.md, SKILL_HE.md, and metadata.json with user-provided arguments like the skill name and author.
Sanitization: The risk of malicious input is significantly mitigated by strict regex validation (KEBAB_CASE_PATTERN) ensuring the skill name only contains lowercase letters, numbers, and hyphens.
[INDIRECT_PROMPT_INJECTION]: The instructions guide the agent to perform external research (Step 4) and link validation (Step 9.5) to ensure the accuracy of the generated skill's content.
Ingestion points: External information from government and official sources enters the agent context through search operations and WebFetch in SKILL.md.
Boundary markers: The instructions focus on manual and automated verification against official domains (e.g., gov.il, kolzchut.org.il), which serves as a natural trust boundary.
Capability inventory: The skill uses Bash (restricted to Python and local scripts) and WebFetch. It does not execute remote code from external sources.
Sanitization: The agent is instructed to cross-reference multiple authoritative sources, reducing the impact of potentially poisoned data from a single source.

skills-il-skill-creator