The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/audit_semver.py employs subprocess.run to execute the git tag command to fetch version information. The implementation uses a static list of arguments and does not invoke a shell, which prevents command injection vulnerabilities.
[DATA_EXPOSURE]: The validation tool scripts/check.py contains logic to proactively search for and flag absolute host paths (e.g., /Users/, /home/, /tmp/) within the skill's files. This acts as a safety measure to prevent developers from accidentally including sensitive local environment information in the package.
[REMOTE_CODE_EXECUTION]: All auditing and validation scripts are provided locally within the skill package. The skill does not perform any network operations to download or execute remote code or unverified third-party dependencies.

repo-docs