The Agent Skills Directory

[SAFE]: The skill and its associated scripts follow secure development practices.
Filename Sanitization: The scripts/assets.py utility employs a slug function to sanitize externally-sourced titles, ensuring that generated filenames are alphanumeric and do not allow path traversal.
XSS Mitigation: The cmd_sheet function, which generates an HTML contact sheet, correctly uses html.escape to sanitize metadata before including it in the report.
Environment-Based Secret Management: API keys for image generation services (OpenAI, Google Gemini) are retrieved from environment variables (OPENAI_API_KEY, GEMINI_API_KEY), avoiding hardcoded credentials.
Restricted Access: The icon download utility uses an allowlist (ICON_SETS) to restrict downloads to known, permissively-licensed icon sets.
Trusted API Usage: Network operations are directed at well-known, reputable technology and cultural institutions (The Met, Openverse, OpenAI, Google).

seenry-assets