The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains instructions for the AI agent to execute a shell command that runs a script named setup.sh from a relative path (../../kit/) outside the skill's own directory. This allows for the execution of code that is not part of the skill's distribution and whose safety cannot be verified.
[DYNAMIC_EXECUTION]: The build.py script uses sys.path.insert to dynamically include a directory located at ../../kit/ into the Python search path and then imports a module named anim. Loading and executing code from relative external paths is a common vector for code injection and supply chain attacks.
[REMOTE_CODE_EXECUTION]: The skill demonstrates a pattern of relying on unverifiable dependencies. Both the shell script (setup.sh) and the Python module (anim) are external to the skill's package but are executed or imported at runtime. This creates a dependency on an external 'kit' whose provenance and security status are unknown within the context of the audited skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (graph labels and numeric values) and uses it to generate a JSON specification file.
Ingestion points: User input is written to a .graph.json file in the user's folder as specified in SKILL.md.
Boundary markers: No explicit delimiters or warnings are used to isolate user data within the generated JSON structure.
Capability inventory: The skill possesses the capability to execute Python scripts (build.py) and shell commands (setup.sh).
Sanitization: The build.py script validates that numeric values are >= 0, and the HTML template uses textContent to render strings, which provides effective protection against XSS and typical injection attacks.

graph