The Agent Skills Directory

[COMMAND_EXECUTION]: The backend script dashboard_server.py invokes several local CLI tools including osascript, pdftoppm, textutil, and the open command. These calls are used to integrate Apple Calendar data, generate document previews, and navigate directories. All such executions utilize subprocess.run with argument lists and shell=False, which prevents command injection from untrusted input.
[SAFE]: The skill's API endpoints for opening and previewing files validate that requested paths remain within the authorized project/case directories. The implementation uses Path.resolve() and parent checks to prevent unauthorized access to the local file system outside of the project scope.
[SAFE]: The dashboard is served via a Python-based HTTP server bound to 127.0.0.1. This configuration restricts access to the local machine, preventing exposure of the case dashboard to the external network.
[SAFE]: The skill accesses local lawyer case files and the local Apple Calendar SQLite database. These actions are aligned with the skill's stated purpose as a productivity tool and use standard libraries like sqlite3 and PyYAML (with safe_load). Ingestion of untrusted data from local case files is mitigated by safe parsing and front-end HTML escaping.

case-dashboard