The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides utility scripts, such as references/anatomy/scripts/capture.mjs and references/anatomy/scripts/drive.mjs, which utilize Node.js spawn to control headless browser instances (Chrome/Chromium) via the DevTools Protocol. These scripts are explicitly used for verifying the visual integrity and rendering of generated diagrams and are considered benign in this context.
[EXTERNAL_DOWNLOADS]: The documentation contains instructions for users to install components via curl from a vendor-controlled domain (april-zhu.com). It also references well-known external resources such as Google Fonts. These are standard implementation practices for the described functionality.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user input (numeric data and object descriptions) and interpolate it into code templates for SVG and WebGL generation. While this presents an injection surface, the provided instructions include escaping mechanisms (e.g., iso.esc), and the risk is assessed as low given the skill's specific purpose.
[DYNAMIC_EXECUTION]: JavaScript evaluation is performed within a headless browser context by the drive.mjs script using Runtime.evaluate. This is a standard procedure for automated browser testing and state verification of web-based components.
[OBFUSCATION]: Base64 encoding is present in several files, notably for embedding binary image textures (references/minicharts/assets/engine.js) and font files (references/teardown/assets/export.js). These are legitimate use cases for creating self-contained HTML deliverables.

atlas-figures