The Agent Skills Directory

[COMMAND_EXECUTION]: The script executes a local safety scanner utility using the subprocess module.
Evidence: subprocess.run([sys.executable, str(scanner_script), str(skill_path), "--json"], ...) in scripts/publish_skill.py.
Security Note: Command execution is performed safely by passing arguments as a list and avoiding the shell (shell=True), which prevents command injection from the user-supplied skill path.
[EXTERNAL_DOWNLOADS]: The skill communicates with an external API to submit skill metadata and content.
Evidence: The submit_to_api function uses requests.post to send data to the endpoint defined by get_api_url() (pointing to skillscatalog.ai).
Context: This network activity is the primary intended function of the publisher skill and targets the vendor's legitimate domain.
[DYNAMIC_EXECUTION]: The script modifies the Python system path at runtime to import shared configuration utilities.
Evidence: sys.path.insert(0, str(SHARED_DIR)) is used to import agentskills_config.
Context: The path is computed relative to the script's location within the skill directory structure, representing a standard pattern for shared resource management in this environment.

skill-publisher