The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render.py utilizes subprocess.check_call to execute the auxiliary script scripts/render_card.py using the current Python interpreter and a list of arguments, ensuring secure process orchestration within the skill.
[DYNAMIC_EXECUTION]: The skill uses dynamic execution for internal logic and testing: scripts/render_card.py uses __import__ to check environment variables, and tests/test_receipt.py uses importlib.util to load and verify the scripts/receipt.py module.
[INDIRECT_PROMPT_INJECTION]: The skill handles potentially untrusted agent run data by using a structured JSON manifest and applying html.escape() to all user-controlled text fields before rendering them into an SVG template, preventing the injection of malicious SVG content.
[DATA_EXFILTRATION]: The skill implements a privacy-by-design approach by hashing evidence items and the manifest with SHA-256 instead of including raw data in the public receipt, which prevents the accidental exposure of sensitive project information.

agent-receipt