The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script render-graphs.js executes the system dot command (Graphviz) to transform Graphviz descriptions into SVG images. Evidence:
The script uses execSync('dot -Tsvg', { input: dotContent }) to pass data safely via standard input (stdin), avoiding shell command injection risks.
The execution is restricted to the local dot utility and is intended for developer use in visualizing documentation flows.
[INDIRECT_PROMPT_INJECTION]: The skill framework establishes a protocol for agents to read, follow, and test instructions from external SKILL.md files, which represents an attack surface. Evidence:
The documentation provides a systematic approach for agents to process external markdown files while enforcing compliance through 'Red Flags' lists and rationalization tables.
The framework includes a verification cycle designed to prevent agents from disregarding safety guidelines when instructed to load and execute new skills.

writing-skills