The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/generate_schematic.py script utilizes subprocess.run to manage the execution of an internal AI generation tool. The implementation correctly passes arguments as a list rather than a single string, which prevents shell command injection vulnerabilities when processing user-provided schematic descriptions.
[EXTERNAL_DOWNLOADS]: The skill communicates with the OpenRouter API (openrouter.ai) in scripts/generate_schematic_ai.py to facilitate schematic generation and review. This external interaction is a declared core feature and requires an API key provided by the user via environment variables, following secure configuration practices.
[INDIRECT_PROMPT_INJECTION]: The skill processes clinical reports, which are untrusted data sources. Evidence Chain: 1. Ingestion Points: Clinical data enters the context via validation scripts like validate_case_report.py. 2. Boundary Markers: Delimiters are not explicitly used in the Python logic, but processing is limited to regex-based scanning. 3. Capability Inventory: The skill possesses local execution (subprocess) and network access (requests). 4. Sanitization: While input text is not sanitized, the deterministic nature of the regex-based validation scripts isolates the data from executable sinks, rendering the risk low.
[CREDENTIALS_SAFE]: The skill utilizes the OPENROUTER_API_KEY for its scientific visualization features. It avoids hardcoded secrets by retrieving the key from environment variables or local .env files, maintaining standard secret management hygiene.

clinical-reports