The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/copyright_case.py uses subprocess.run to call git check-ignore, which is a standard procedure to identify and exclude ignored files from the copyright material processing. Additionally, the evaluation script evaluations/2026-11-07/run_demo.py uses subprocess.run to execute synthetic code for testing purposes.
[DYNAMIC_EXECUTION]: In scripts/render_materials.py, __import__ is used to programmatically load the docx library for document styling. The verification script evaluations/2026-11-07/render_word_qa.py also uses Windows COM automation via win32com to inspect generated materials.
[EXTERNAL_DOWNLOADS]: The requirements-render.txt file specifies standard, reputable Python libraries for document generation and image processing from PyPI, such as python-docx, reportlab, and Pillow.
[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection because it reads untrusted project source code into the agent's context (ingestion point: scripts/copyright_case.py). There are no explicit boundary markers or sanitization procedures for this input. However, the risk is mitigated as the skill's capabilities are limited to local file generation and the ingestion is a core requirement of its primary functionality.

light-software-copyright