The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/validate_skill.py script uses the subprocess.run function to execute an internal validator script (validate_template.py). This operation is safe as it uses the absolute path of the current Python interpreter (sys.executable) and passes arguments as a list, avoiding shell injection risks.
[DYNAMIC_EXECUTION]: The script scripts/preview_template.py dynamically generates an HTML file by injecting JSON data into a template. This is a local development utility for previewing report styles and includes basic string-based escaping for JSON characters to mitigate simple injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill framework facilitates the injection of analysis results into web reports. The included example templates follow security best practices by using textContent for rendering data, which protects against cross-site scripting (XSS) and other injection attacks within the generated reports.
[CREDENTIALS_SAFE]: The skill does not contain any hardcoded API keys, tokens, or passwords. It correctly instructs users to manage calculation definitions through official metric and table manuals.

data-agent-arcvis-skill