The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/generate_diagram.py implements a mathematical expression evaluator using the Python eval() function to render custom plots.
Evidence: The plot_function in scripts/generate_diagram.py takes the --expr argument directly from the command line and passes it into eval().
Risk: While the script attempts to restrict the evaluation environment to a specific dictionary of math functions, eval() is notoriously difficult to secure in Python. An attacker could potentially craft a payload to bypass these restrictions, leading to arbitrary code execution on the host machine.
[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md and references/python-diagrams.md encourage the AI agent to construct and execute shell commands targeting the generate_diagram.py script based on user-provided descriptions.
Evidence: The agent is instructed to use the command python scripts/generate_diagram.py --type function --expr "..." to handle complex visualizations.
Risk: If the agent naively interpolates user input into the --expr flag, a prompt injection attack could lead the agent to execute malicious Python code through the script's eval() sink.

obsidian-visuals