The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses Python scripts to perform availability checks against well-known services. Specifically, scripts/github-name-check.py fetches data from api.github.com, scripts/npm-org-check.py queries npmjs.com and registry.npmjs.org, and scripts/tld-finder.py accesses data.iana.org. These are legitimate, neutral operations targeting established platforms for their intended purpose.
[COMMAND_EXECUTION]: The skill includes several Python scripts (scripts/analyze-logo.py, scripts/favicon_preview.py, scripts/png_alpha_check.py, scripts/png_to_ico.py, scripts/rasterize_svg.py) that perform local image processing and file auditing. These scripts utilize standard libraries like argparse, struct, and zlib, as well as optional common packages like Pillow and cairosvg. The execution is limited to local file system operations requested by the user for branding asset management.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in workflows/brand-research.md, which ingests information from competitor websites and market research.
Ingestion points: workflows/brand-research.md reads content from official websites, third-party directories, and review sites.
Boundary markers: The skill uses confidence levels (High/Medium/Low) and explicit evidence labels (Fact, Quote, Inference) defined in references/brand-research-report.md to distinguish external content.
Capability inventory: Subprocess calls are present in the asset scripts, but they operate on file paths rather than directly executing interpolated strings from the research.
Sanitization: The skill instructs the agent to cite source URLs and clearly label synthesis, reducing the risk of accidental instruction obedience.
[CREDENTIALS_UNSAFE]: The scripts/x-name-check.py script utilizes an environment variable X_BEARER_TOKEN for API authentication. This follows the safe practice of using environment-based secret management rather than hardcoding credentials.

chrisai-branding