The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/check.py file uses subprocess.run to invoke local validation scripts such as validate_skill.py and tag_report.py. These calls are restricted to the local environment and use the current Python interpreter with hardcoded or script-derived paths, preventing command injection.
[SAFE]: The skill utilizes yaml.safe_load in scripts/tag_report.py to parse skill frontmatter, which is a secure practice that prevents arbitrary code execution during YAML deserialization.
[SAFE]: Text analysis for tag inference is performed via static regular expressions defined in TAG_RULES. This logic does not execute or interpret the content being analyzed, mitigating risks from indirect prompt injection in skill descriptions.

skill-tag-taxonomist