The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a modular architecture where a central script (web_design_picker.py) and an orchestration script (run_factory.py) execute other Python scripts in the package via subprocess.call and subprocess.run. Additionally, optimize_video.py executes ffmpeg/ffprobe, and make_favicons.py executes resvg. These executions are essential for the skill's functionality (media optimization and image rendering). Input validation is consistently applied to project paths and filename stems using the validate_output_stem helper to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill's documentation and requirements-optional.txt specify dependencies on well-known libraries and tools including Pillow, PyYAML, playwright (which downloads Chromium), and resvg-cli. These are standard tools for image processing and browser automation required for the skill's primary tasks.
[DATA_EXPOSURE]: The packaging logic in scripts/package_delivery.py and scripts/_common.py includes proactive security scanning. The archive_secrets and deterministic_zip functions explicitly check for and block the inclusion of sensitive files such as .env files, SSH private keys, and files containing private key markers (e.g., -----BEGIN PRIVATE KEY-----) in the final delivery archives.
[SAFE]: The skill demonstrates high security awareness by implementing guards against path traversal and symlink attacks. The reject_symlinks function prevents the tool from following external links during file operations, and safe_archive_path ensures that all files added to ZIP archives remain within the intended directory structure.

web-design-picker