The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run() to manage repository operations. These calls are used legitimately to interface with git, node, npx, and the gh (GitHub CLI) tool for project management tasks such as versioning, auditing, and publishing. The commands are constructed as lists and do not involve shell interpolation of untrusted strings.
[CREDENTIALS_SAFE]: Includes a dedicated script (scripts/scan_skill_release.py) that performs both regex-based and Python AST-based scanning to detect and block the inclusion of API keys, private keys, and other sensitive credentials in the skill payload before publication. It specifically redacts these values in its own output to prevent accidental exposure.
[EXTERNAL_DOWNLOADS]: Interacts with GitHub (github.com/zjp1997720/zhijian-skills) for repository management. GitHub is a trusted service, and all interactions are conducted through standard git and CLI tools.
[PERSISTENCE]: The scripts/git_sync_guard.py script installs a git pre-commit hook. This is a documented and intended mechanism designed to prevent developers from committing code to a stale branch, ensuring synchronization with the remote repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided SKILL.md files during auditing. However, the risk is mitigated because the processing is limited to static analysis (regex and AST parsing) and the data is not executed or interpreted as high-privilege instructions. Mandatory evidence chain:
Ingestion points: SKILL.md and skill directories analyzed in scripts/portfolio.py and scripts/scan_skill_release.py.
Boundary markers: Not applicable as content is parsed statically, not interpreted by an LLM at the processing step.
Capability inventory: Filesystem read/write and subprocess execution for git/npx tools.
Sanitization: Strong sanitization logic in scripts/scan_skill_release.py to identify and block malicious content patterns.

skill-open-sourcer