The Agent Skills Directory

[SAFE]: The skill's primary purpose is document generation, and all analyzed code supports this goal without introducing security risks. The architecture emphasizes self-contained artifacts and local processing.
[COMMAND_EXECUTION]: The build pipeline uses Node.js (via mathbuild.js) and Python (via qa.py) to automate document processing and quality assurance. This includes the expected use of Playwright to launch a headless browser for rendering and PDF generation. All commands are local and intended for the skill's functionality.
[EXTERNAL_DOWNLOADS]: The skill references standard dependencies like KaTeX and Playwright/Chromium. The documentation provides clear instructions for installing these through official package managers (npm/pip) and recognized installers, which are well-known and trusted services.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to generate HTML documents, which is an inherent attack surface for this type of tool. However, it implements a security helper (esc in figures.py) to escape strings for HTML/SVG and uses rigid templates, which significantly mitigates the risk of unintentional command injection through processed data.
[OBFUSCATION]: The mathbuild.js script employs Base64 encoding to inline font files directly into CSS. This is a legitimate and documented technique used here solely to ensure the output documents remain portable and functional without internet access.

korean-report-doc