The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_recipe_diagram_png.py invokes the ImageMagick magick utility using subprocess.run. The implementation uses an argument list rather than a shell string, and the paths for the SVG input and PNG output are managed securely, preventing shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted recipe data provided by users. To mitigate risks where malicious instructions might be embedded in the recipe text, the skill transliterates all input strings to ASCII and applies HTML escaping to labels before embedding them into the intermediate SVG file. These sanitization steps prevent the processed data from being interpreted as code or instructions by the rendering engine.
[SAFE]: The skill does not perform any network operations, access sensitive credentials, or attempt to persist across sessions. It uses local, verifiable scripts for its primary logic.

do-recipe-diagrams