The Agent Skills Directory

[SAFE]: The skill is a well-documented and professionally structured toolkit for local asset generation. It includes explicit security and best-practice guidance, such as avoiding live API calls and ensuring accessibility through alternative text.
[COMMAND_EXECUTION]: The toolkit uses execFileSync to run FFmpeg for processing video frames into still images and utilizes the Playwright library to automate browser-based verification of the final SVG files. These command executions are localized to the developer's environment and use inputs provided by the user for the express purpose of card creation.
[INDIRECT_PROMPT_INJECTION]: The skill defines a data ingestion surface by reading from product repositories (e.g., CSS tokens, font files, and source code) to accurately redraw user interfaces. The risk associated with this ingestion is mitigated by the skill's design as a local development tool and the inclusion of a dedicated validator (kit/check-card.mjs) that audits the output SVG to ensure it adheres to GitHub's restricted image sandbox (which prohibits scripts and external resources).
[EXTERNAL_DOWNLOADS]: The documentation encourages the installation of well-known, reputable libraries (opentype.js, playwright-core) from official package registries and the use of standard system tools like FFmpeg.

chanmeng-svg-product-card