The Agent Skills Directory

[SAFE]: The skill's primary function is to provide technical auditing and utilities for 2D rigging and skinning workflows, which is consistent with its stated purpose.
[COMMAND_EXECUTION]: The testing scripts scripts/test_audit_skin.py and scripts/test_measure_surface.py use the subprocess module to execute the project's own Python scripts for unit testing purposes.
These calls are limited to the current Python interpreter (sys.executable) and do not process unsanitized user input in a shell context.
[EXTERNAL_DOWNLOADS]: The documentation contains links to official resources for Spine, DragonBones, and the author's own reference implementations.
These are categorized as references to well-known technology providers and vendor-owned resources, posing no risk to the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes external JSON and image assets for auditing.
Ingestion points: scripts/audit_skin.py, scripts/audit_attachment_ownership.py, and scripts/measure_surface.py read JSON trace files and image atlases.
Boundary markers: The scripts strictly enforce schema versions (e.g., ogs.skin-trace/1) and perform JSON object validation.
Capability inventory: The scripts have the capability to write report files to disk but do not possess network or arbitrary shell execution capabilities on the processed data.
Sanitization: Path traversal is prevented in scripts/audit_attachment_ownership.py by checking that file paths do not escape the declared package directory using is_relative_to. Asset integrity is verified using SHA256 hashes.

spine-skeletal