The Agent Skills Directory

[SAFE]: The skill uses yaml.safe_load for parsing skill frontmatter, which is a secure practice that prevents the execution of arbitrary code during data deserialization.
[COMMAND_EXECUTION]: The scripts/check.py script utilizes subprocess.run to execute local validation and packaging utilities. These calls use argument lists rather than raw shell strings, which is a safe implementation for internal developer tooling.
[SAFE]: The indexing logic in scripts/skill_index.py includes safety-conscious features such as limiting the amount of text read from skill files and surfacing warnings for skills that declare hooks or contain scripts. This encourages user inspection before executing potentially risky third-party content.
[DATA_EXFILTRATION]: No network capabilities or exfiltration patterns were identified. The skill operates exclusively on the local filesystem to manage and retrieve skill metadata.

skill-router