The Agent Skills Directory

[SAFE]: The skill implements a straightforward text-processing workflow using a local Python script (scripts/main.py). No malicious patterns or security vulnerabilities were identified in the implementation.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script. This is the primary functionality of the skill and is clearly documented for the purpose of flashcard generation. The script uses standard library modules (argparse, re) and does not involve risky execution patterns like shell=True or eval() on untrusted input.
[DATA_EXPOSURE]: The script accesses the local file system to read study content (--input) and write generated decks (--output). This behavior is consistent with the utility's purpose. There are no network operations, and data remains within the local environment unless manually shared by the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes external text files which could technically contain instructions for the agent. However, the SKILL.md and references/audit-reference.md provide clear boundary guidelines and fallback instructions to maintain scope and avoid fabricating content. The risk is minimized by the highly structured output format (TSV).

anki-card-creator