The Agent Skills Directory

[SAFE]: The skill is entirely defensive in nature, providing a structured approach for an agent to safely evaluate and audit third-party skills before installation. It does not contain any executable code, network operations, or malicious patterns.
[DYNAMIC_CONTEXT_INJECTION]: The skill's audit checklist explicitly identifies dynamic context execution (!`command` syntax) as a critical security 'red flag' to watch for in other skills.
[DATA_EXFILTRATION]: The audit checklist correctly identifies the use of network tools (curl, wget) and the reading of sensitive environment variables or credentials as suspicious behaviors that should lead to the rejection of a skill candidate.
[PRIVILEGE_ESCALATION]: The instructions warn against skills that attempt to modify shell configurations or request unnecessary global installation permissions.
[INDIRECT_PROMPT_INJECTION]: The skill includes instructions to treat external skill definitions as untrusted data, requiring a manual audit against a security checklist rather than treating them as authoritative instructions.

find-skills