The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/explorer.py uses subprocess.Popen to launch a local Python http.server. This is intended to serve the generated explorer.html dashboard. The server is correctly restricted to the loopback interface (127.0.0.1) and constrained to the results directory, preventing unauthorized external access or arbitrary file exposure.
[SAFE]: Static detection flagged Unicode separator characters (U+2028 and U+2029) in scripts/explorer.py. Manual inspection confirms these are used as part of a replace operation to sanitize JSON payloads before they are embedded into the HTML explorer. This is a security best practice implemented to prevent JSON-in-HTML injection attacks.
[SAFE]: The skill implements path traversal protections in scripts/explorer.py by using os.path.commonpath and verifying that all discovered results files are sub-paths of the designated results directory. This prevents the explorer from accessing or serving files outside the intended scope.

rigorous-experiments