The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check.py utilizes subprocess.run() to execute internal validation tools such as validate_skill.py and tag_report.py. These execution paths are statically derived from the local file system relative to the skill's directory, limiting the scope to trusted internal scripts.
[SAFE]: The scripts/tag_report.py script employs yaml.safe_load() to process frontmatter from repository metadata files. This is a security best practice that prevents arbitrary code execution during YAML deserialization.
[SAFE]: The skill's operation is restricted to the local repository environment. It does not attempt to make external network requests, access sensitive system credentials (like .env or SSH keys), or use obfuscation techniques to hide its logic.
[SAFE]: The evals/evals.json file includes specific test cases to ensure the agent does not perform destructive actions, such as manually editing generated catalog indexes, reinforcing the skill's safe operational boundaries.

skill-tag-taxonomist