The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/render.py and tests/test_summarize.py utilize subprocess.check_call to manage internal execution flow. These calls are confined to running local Python scripts using the current system interpreter and hardcoded or temporary file paths, which prevents unauthorized command injection.
[DYNAMIC_EXECUTION]: The script scripts/render_card.py uses __import__('os') to check for specific environment variables (e.g., EDGE_SKIP_PNG). This is a standard and safe implementation for conditional logic based on the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data containing performance results. To mitigate potential injection risks from malicious data content, scripts/render_card.py implements an escaping function using html.escape for all data interpolated into the SVG output templates, ensuring that the generated reports remain secure.

invocation-doctor