The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/compile_tikz.py uses the subprocess.run function to execute external system binaries, specifically pdflatex for compiling TikZ diagrams and convert (ImageMagick) for generating PNG images from PDF outputs. It also invokes platform-specific commands (open, xdg-open, start) to preview generated diagrams.
[INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface for indirect prompt injection. It ingests user-provided text (such as node labels, descriptions, and component values) and interpolates this data into Python scripts or LaTeX files. These files are subsequently executed or compiled without explicit sanitization or the use of boundary markers, which could allow malicious instructions embedded in diagram requirements to be processed by the LaTeX compiler or Python interpreter. Evidence found in SKILL.md (instructions) and scripts/compile_tikz.py (execution capability).
[EXTERNAL_DOWNLOADS]: The documentation in SKILL.md provides instructions for installing well-known scientific and imaging libraries, including graphviz, pygraphviz, pydot, schemdraw, networkx, matplotlib, pytesseract, and pdf2image. It also requires system-level tools such as pdflatex and ImageMagick.
[PRIVILEGE_ESCALATION]: Documentation within SKILL.md includes instructions for installing the graphviz system binary on Linux distributions using sudo apt-get install, which is a standard procedure for installing required packages but involves elevated privileges.

scientific-schematics