The Agent Skills Directory

[SAFE]: Extensive analysis of the skill body, scripts, and configuration revealed no malicious patterns or vulnerabilities. The skill adheres to local-first privacy principles.
[COMMAND_EXECUTION]: The skill utilizes Python's subprocess and Node.js child_process modules within its testing framework and release scripts. These operations are limited to Git commands for packaging and orchestrating internal test suites, which are standard and legitimate development activities.
[DATA_EXFILTRATION]: Project data and discovery survey answers are stored in local SQLite databases. The scripts enforce strict security by setting file permissions to owner-only (0600) and binding the local servers exclusively to 127.0.0.1. This ensures that sensitive information never leaves the user's local environment.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted user input for survey answers and task feedback, it implements robust defenses. The Python backend uses parameterized SQLite queries to prevent injection, and the frontend applications use secure rendering methods. Automated tests specifically confirm that hostile markup or scripts provided in user input are not executed.
[EXTERNAL_DOWNLOADS]: The skill provides optional pointers to vendor-owned tools and trusted repositories (e.g., Anthropic and Vercel labs). These references are used for extending prototype capabilities and follow secure, transparent practices for skill installation.

prototyper