The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes Python scripts (generate-sharp-plan.py, generate-ffmpeg-plan.py) to generate shell command plans for external tools such as ffmpeg, sharp-cli, and svgo. The instructions mandate that the agent or user review these generated plans before execution to ensure accuracy and safety.
[COMMAND_EXECUTION]: The scripts/generate-ffmpeg-plan.py script generates a cleanup command (rm -f) to remove temporary logs created during two-pass encoding. All generated commands employ shlex.quote to sanitize file paths, which effectively mitigates command injection risks originating from maliciously crafted asset filenames.
[PROMPT_INJECTION]: The skill processes project-specific data (HTML, CSS, and configuration files) to build an optimization strategy, which constitutes an indirect prompt injection attack surface.
Ingestion points: scripts/scan-assets.py recursively reads text and binary content from files within the project root directory provided by the user.
Boundary markers: The skill uses structured JSON as an intermediate format to pass data between scanning and planning phases, though it does not implement explicit boundary markers for the final AI strategy report.
Capability inventory: The skill generates and executes shell commands for asset transformation and file system cleanup, and it patches project markup files.
Sanitization: The Python scripts use shlex.quote for all path-based command arguments, ensuring that metadata or filenames extracted from the project cannot break the shell command structure.

web-assets-optimization