The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/render-report.py to invoke ffmpeg for video conversion and in scripts/test-render.py for execution of tests. Additionally, references/performance/benchmark-checklist.md directs the agent to use system profiling and monitoring tools such as uptime, nproc, top, pidstat, perf, py-spy, and strace. These commands are appropriately used for the skill's primary purpose of verification and performance measurement.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from repository files (e.g., source code, QA lists). It includes specific defensive instructions in references/stress/break-ui.md to ignore any control sequences or instructions embedded in this data (such as 'ignore previous instructions'), effectively mitigating potential indirect prompt injection attacks.- [EXTERNAL_DOWNLOADS]: The skill references dependencies and upstream sources from GitHub (including organizations such as backnotprop, emilkowalski, and vercel-labs) within its manifest. It also suggests the use of standard package managers (npx, pip) to install verification tools like Playwright if they are missing from the environment.- [SAFE]: The skill demonstrates strong security posture by implementing a bad_path validation function in scripts/validate_report_lib.py that restricts media paths to be relative and internal to the run folder, preventing directory traversal and metacharacter injection. It also uses comprehensive escaping logic in the report-template.html to prevent cross-site scripting (XSS) in generated reports.

atlas-verify