The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from layout.json files which include user-controlled text labels. This ingestion surface is well-managed: the skill requires a specific JSON schema and uses html.escape() in the svg_template.py script to sanitize all text content before it is rendered in the final SVG file. This prevents malicious payloads from being executed in the context of the generated SVG.
[DYNAMIC_EXECUTION]: The skill's primary workflow involves executing its own local Python scripts to build and validate diagrams. These scripts use standard library modules (xml.dom.minidom, math, re) and avoid dangerous execution patterns such as using eval() or exec() on untrusted input strings.

research-figure