The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/html_to_pdf.py executes the wkhtmltopdf binary using subprocess.run for PDF conversion. It appropriately uses a list of arguments to mitigate shell injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate HTML magazine layouts which are then converted to PDF. The instructions mandate that the agent preserve all user content without sanitization, creating a surface where malicious HTML tags (such as <iframe> or <object>) could be inserted. If processed by the conversion engines (Playwright or wkhtmltopdf with --enable-local-file-access), this could lead to local file inclusion within the final PDF.
Ingestion points: User-provided text content processed according to instructions in SKILL.md.
Boundary markers: None present.
Capability inventory: Use of wkhtmltopdf via subprocess.run and Playwright browser automation in scripts/html_to_pdf.py.
Sanitization: None; the agent is specifically instructed to retain all original user content.
[EXTERNAL_DOWNLOADS]: The skill references and encourages the installation of well-known PDF conversion tools including Playwright and WeasyPrint, which are standard utilities in their respective ecosystems.

magazine-layout