The Agent Skills Directory

[COMMAND_EXECUTION]: The render-graphs.js script executes the system dot command via child_process.execSync to generate SVG diagrams from Graphviz blocks. This is legitimate developer functionality.
[INDIRECT_PROMPT_INJECTION]: The render-graphs.js script reads SKILL.md content and pipes it to a shell command. 1. Ingestion points: render-graphs.js reads file content. 2. Boundary markers: Uses markdown code block regex. 3. Capability inventory: child_process.execSync. 4. Sanitization: Absent. While it uses markdown delimiters, the lack of deep sanitization creates a minor attack surface for data processed at runtime.
[SAFE]: The skill uses established psychological principles (Authority, Commitment) in its instructions to ensure agents follow strict procedural requirements. This is intended for discipline enforcement, not malicious manipulation.

writing-skills