The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses shell commands to install external packages at runtime (e.g., pip install pdoc, npm install typedoc) and executes remote code using npx (e.g., npx widdershins). This represents an execution surface that relies on the integrity of third-party package registries.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool and Python's subprocess.run to manage the documentation build pipeline, including starting local development servers for screenshot capture and opening generated files in the system shell (start / open).
[EXTERNAL_DOWNLOADS]: The skill fetches several JavaScript and CSS libraries (marked.js, highlight.js, mermaid.js) from well-known CDNs (unpkg.com, jsdelivr.net) to bundle them into the final single-file HTML manual.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by reading and processing project source code and documentation. Adverarial content embedded in these files could potentially influence the sub-agents (universal-executor) responsible for analyzing the project sections.
[DYNAMIC_EXECUTION]: The extract_apis.py script dynamically imports the user's FastAPI application (from app.main import app) to extract OpenAPI schemas. This involves executing local project code within the skill's environment.

software-manual