The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local commands to generate schematics and convert documents. The script scripts/generate_schematic.py uses the subprocess module to wrap a helper script, passing user-provided arguments as a list to avoid shell injection. Additionally, the skill's instructions guide the agent to use google-chrome and libreoffice via the Bash tool for rendering and format conversion.
[EXTERNAL_DOWNLOADS]: The scripts/generate_schematic_ai.py script performs network requests to openrouter.ai. This is a well-known service used to access AI models for generating scientific images and performing quality reviews.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of user-provided diagram descriptions. Untrusted data enters the agent context through the prompt argument in scripts/generate_schematic.py. This input is interpolated into a fixed prompt template within scripts/generate_schematic_ai.py before being sent to an external API. The skill possesses capabilities for both local command execution and network communication. No explicit sanitization or filtering of the user-provided prompt was found. Specifically: (1) Ingestion points: prompt argument in scripts/generate_schematic.py. (2) Boundary markers: User input is delimited by a hardcoded instruction template. (3) Capability inventory: Access to shell tools (Bash) and network operations (requests). (4) Sanitization: None observed.

pptx-posters