The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's Python script (render_card.py) uses subprocess.run to invoke the rsvg-convert system utility for SVG-to-PNG conversion. This execution is confined to a specific utility using templated, local file paths and does not facilitate arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a local ledger (memory/token-usage.csv). It implements proper XML escaping (sanitizing '&', '<', '>') for all values extracted from the CSV before embedding them into the SVG image, effectively preventing injection attacks or malformed artifact generation from untrusted ledger entries.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses internal token usage telemetry to generate reports and visualizations. The data is processed locally, and the resulting summaries are sent via a local notification script. No sensitive credentials or private files are accessed or transmitted.

weekly-aeoncard