The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts (e.g., scripts/validate_skill.py, tests/test_scaffold_deck.py) use subprocess.run() to execute other scripts within the same repository for validation and automated testing purposes. These calls are benign and essential for the package's integrity checks.
[DYNAMIC_EXECUTION]: Build and validation scripts use importlib.util to dynamically load and interact with internal renderer modules. This is used solely for repository maintenance and site generation, not for executing untrusted external code.
[DATA_EXPOSURE_EXFILTRATION]: The optional web-based 'Try' functionality in the docs/ directory uses a Bring Your Own Key (BYOK) pattern. It allows users to input their Anthropic API key, which is stored in the browser's localStorage and sent directly to api.anthropic.com. This architecture ensures the key never touches the author's servers, following secure client-side integration practices for well-known services.
[INDIRECT_PROMPT_INJECTION]: The skill processes user notes by interpolating them into a system prompt for an LLM to generate JSON specs. While this presents an ingestion surface, the skill includes explicit 'Expert Review' instructions and a quality rubric to help users detect and mitigate potential hallucinations or adversarial content in the output.

strategy-consulting-visualization