add a new metadata field for notes

Author: righettod

.claude/skills/secure-microsoft-word-validation/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: secure-microsoft-word-validation
-description: Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. Remote template references and external linked-image/content relationships are not blocked by this skill so that legitimate Word templates and linked images remain usable. Apply network-level controls or a dedicated content-inspection layer to cover those vectors if needed.
+description: Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
 allowed-tools: Read Grep Glob
 metadata:
   category: security
+  security-considerations: 
+    - Remote template references and external linked-image/content relationships are not blocked by this skill so that legitimate Word templates and linked images remain usable.
+    - Apply network-level controls or a dedicated content-inspection layer to cover those vectors if needed.
 ---
 
 # Secure Microsoft Word File Validation Code Generation Rules

.claude/skills/secure-relative-url-validation/SKILL.md

@@ -1,9 +1,11 @@
 ---
 name: secure-relative-url-validation
-description: Generate secure relative url validation code for open redirect prevention. Intentionally strict — rejects valid but risky relative URL forms such as `../page`, `?query`, and `#anchor`. Invoke when writing any relative url validation related code.
+description: Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
 allowed-tools: Read Grep Glob
 metadata:
   category: security
+  security-considerations: 
+    - Intentionally strict, it rejects valid but risky relative URL forms such as "../page", "?query", and "#anchor".  
 ---
 
 # Secure URL Validation Code Generation Rules

CLAUDE.md

@@ -20,9 +20,16 @@ description: ...              # what it does and when to invoke it
 allowed-tools: Read Grep Glob # tools the skill may use without approval
 metadata:
   category: security          # all skills in this repo use category: security
+  security-considerations:    # optional, provide information about threats not covered or strictness of controls applied.
+    - ... 
 ```
 
-Do not add fields outside the agentskills.io spec at the top level. Non-standard fields belong under `metadata`.
+Do not add fields outside the `agentskills.io` spec at the top level. Non-standard fields belong under `metadata`.
+
+Mandatory or optional presence of fields in the section `metadata`:
+
+- `security-considerations` is **optional**.
+- `category` is **mandatory**.
 
 ### Body structure
 
@@ -34,6 +41,7 @@ Every skill must have:
    - A Java BAD/GOOD code example illustrating every rule.
 3. A `## 2. Output Checklist` section with one checkbox per rule.
 4. A `## References` section linking to one or several of the following authoritative sources: OWASP, PORTSWIGGER, MITRE, NIST, ANSSI, SANS, MICROSOFT, ECMA.
+5. A *Frontmatter section* fully valid according to the rules defined in the section `Frontmatter (valid fields only)`.
 
 ### Code snippet formatting rules
 
@@ -53,7 +61,7 @@ Before adding or modifying a skill, verify:
 - Code snippets declare all variables they use.
 - Security gaps covered: No case is missing.
 - Skill follow a consistent `secure-<subject>-<action>` naming pattern.
-- Code snippets follow the formatting rules above (no 80-column wrapping, no alignment padding).
+- Code snippets follow the formatting rules defined into the section `Code snippet formatting rules` (no 80-column wrapping, no alignment padding).
 
 ## Validation
 

README.md

@@ -24,6 +24,8 @@
 
 📄 The convention to create a skills is specified into the [CLAUDE.md](CLAUDE.md) file.
 
+💡 If a skills has limitations or a specific behavior then it is documented into the `metadata` field named `security-considerations`.
+
 ## Commands
 
 ✅ In *Claude code* use the following commands: