The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check.py uses subprocess.run to execute internal validation tools such as validate_skill.py, validate_evals.py, and package.py. These commands use hardcoded paths relative to the script's directory and do not incorporate unvalidated user input, making them safe for their intended purpose of checking skill integrity.
[EXTERNAL_DOWNLOADS]: The skill's documentation and reference files (e.g., modern-css.md, shadcn-patterns.md, tailwind-v4.md) reference official documentation from well-known services and trusted organizations including GitHub, React, Tailwind CSS, and shadcn/ui. These references are used for educational and guidance purposes and do not involve downloading or executing untrusted code.
[DATA_EXFILTRATION]: The skill includes explicit rules and logic to prevent the exposure of sensitive data. SKILL.md contains instructions to avoid committing sensitive files like .env, HAR files, or heap snapshots. The scripts/asset_toolkit/package.py script specifically filters out common metadata and temporary files when bundling the skill, ensuring that only necessary and safe assets are packaged.
[SAFE]: The skill uses safe programming practices, such as employing yaml.safe_load for parsing frontmatter in scripts/asset_toolkit/_shared.py and scripts/asset_toolkit/common.py, which prevents arbitrary code execution during YAML deserialization.

design