The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script render-graphs.js uses child_process.execSync to invoke the system dot command-line tool (Graphviz). The script securely passes the graph content to the binary via standard input (stdin) rather than command-line argument interpolation, which mitigates standard command injection risks. This tool is intended for local visualization of the skill's flowcharts.
[INDIRECT_PROMPT_INJECTION]: The skill's primary methodology involves an agent ingesting and 'pressure testing' new or unverified skill instructions using subagents. This creates a surface for indirect prompt injection if the instructions being tested contain malicious patterns designed to influence the subagent's behavior. The skill mitigates this by providing a structured testing protocol and boundary markers (e.g., announcing skill usage), but the inherent attack surface for processed data exists.

writing-skills