The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts render_graphs.py and scan.py utilize subprocess.run to interface with system utilities such as git and graphviz (dot). These calls are implemented using argument lists rather than shell strings, preventing shell injection vulnerabilities. The operations are standard for the tool's purpose of managing repositories and generating documentation assets.
[DATA_EXFILTRATION]: The scripts/scan.py utility is a security-enhancing tool designed to detect sensitive data (API keys, work emails, and hardcoded paths) within a project directory. Its purpose is to prevent accidental data exposure before a repository is shared publicly.
[REMOTE_CODE_EXECUTION]: The skill's Python scripts safely parse configuration and metadata using yaml.safe_load. This prevents the execution of arbitrary Python objects during YAML deserialization, which is a common vector for remote code execution in AI agent extensions.

skill-forge