The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/export_figure.py script executes the drawio command-line utility via subprocess.run to convert diagram files into PNG or PDF formats. The implementation uses a list of arguments, which is the recommended method to prevent shell-based command injection.- [DATA_EXPOSURE]: The scripts/preview_html.py utility launches a temporary local web server using Python's http.server module to allow users to preview diagrams in their browser. The server is restricted to the local loopback interface (127.0.0.1), ensuring the content is not exposed to the network.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied research data to populate diagram templates. The documentation in references/authoring.md explicitly instructs the agent to use html.escape for user-provided text, which demonstrates a defensive approach against content-based structural injection in the generated XML files.

scibox-diagram