The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Python script generate-dashboard.py and a support script resolve-assumptions.py to process data. Commands are constructed using direct paths and arguments are passed as lists to the execution environment, which is a safe pattern.
[DATA_EXPOSURE]: The skill reads project configuration files (consult-project.json, field.json) and research files within the selected engagement directory. These operations are restricted to the local workspace and intended for dashboard generation.
[INDIRECT_PROMPT_INJECTION]: The skill processes project metadata (titles, framings, deliverable names) which could contain malicious instructions. However, the generate-dashboard.py script uses html.escape() for all interpolated data fields before rendering them into the HTML template, effectively mitigating cross-site scripting (XSS) or injection risks in the generated dashboard.
[DYNAMIC_EXECUTION]: The SKILL.md instructions include a Python one-liner (python3 -c) used to process JSON output from a resolution script and update the dashboard file. This is a targeted data transformation step that operates on data generated by the skill's own trusted toolset.

consult-dashboard