The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/gen_receipt.py executes local CLI tools including ccusage, qrencode, Google Chrome, and magick using the subprocess module to gather data and render images. These tools are expected to be pre-installed on the host system.
[COMMAND_EXECUTION]: The script passes user-controlled parameters, such as the customer name and YouTube URL, directly to subprocesses. By using shell=False (the default), it prevents shell command injection vulnerabilities.
[SAFE]: The skill processes data from local ccusage logs and applies html.escape to all dynamic strings before they are interpolated into the HTML template. This sanitization effectively mitigates indirect injection risks during the receipt rendering process.

token-receipt