The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones the repository 'https://github.com/Kanahiro/chiitiler' into a local directory to use its rendering capabilities.
[REMOTE_CODE_EXECUTION]: It executes the downloaded code from the 'chiitiler' repository using 'npx tsx src/main.ts' without verifying the integrity or version of the source.
[COMMAND_EXECUTION]: The script generates Python code at runtime by interpolating shell variables directly into heredoc blocks (e.g., 'python3 << PYSTYLE'). Variables like '$PMTILES_PATH' and '$BASEMAP_URL' are inserted into the Python source without sanitization, posing a risk of arbitrary code execution if these variables contain malicious sequences.
[COMMAND_EXECUTION]: Shell variables are interpolated into Python command strings (e.g., 'python3 -c "... open('$COLLECTION_DIR/collection.json') ..."'), which is vulnerable to injection if directory names or file paths contain single quotes or other shell-breaking characters.
[EXTERNAL_DOWNLOADS]: The skill fetches map tiles from well-known services including CartoDB, OpenStreetMap, and Stadia Maps to provide background layers for the thumbnails.

portolan-thumbnails