The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions leverage the Bash tool to execute curl and python3 commands.
The curl utility is used to interact with the backend REST API for presigning and publishing assets.
python3 is used as a secure way to generate and parse JSON payloads using the standard json and os modules, which avoids shell escaping vulnerabilities.
[DATA_EXFILTRATION]: The skill facilitates the transmission of local file data to an external service endpoint defined by the $PYLOT_GATEWAY_URL environment variable.
This transmission is the documented primary purpose of the skill, intended to store and share visual artifacts for project documentation.
The flow includes local file reading, S3 presigned URL usage, and API publication steps.
[INDIRECT_PROMPT_INJECTION]: The skill ingests local file paths and produces public URLs that are then intended for embedding in external systems like GitHub Pull Requests or Slack threads.
This creates an automated bridge for data to flow from the local environment to public or shared platforms.
[SAFE]: The skill maintains security by utilizing environment-provided authentication tokens ($PYLOT_DISPATCH_TOKEN) and gateway URLs, ensuring that no sensitive credentials or specific backend configurations are hardcoded in the skill definition.

evidence-upload