The Agent Skills Directory

[COMMAND_EXECUTION]: The core script hanzi_lens.py manages workflows by executing sub-commands for project scaffolding, font validation, and rendering. These executions are performed using argument lists rather than shell strings, which mitigates command injection risks. The paths for dependency tools are resolved through controlled environment variables and relative installation directories.
[EXTERNAL_DOWNLOADS]: The skill utilizes well-known and standard dependencies such as fonttools for glyph coverage checks and playwright for image rendering. These are installed through official package registries as documented in the setup instructions.
[PROMPT_INJECTION]: The skill processes research data (research.json, source.md) to generate visual assets, creating an indirect prompt injection surface. However, it implements a proactive defense through its audit command, which scans ingested content for placeholders and inappropriate inference patterns before allowing output generation.
[DATA_EXFILTRATION]: File system access is restricted to local research project directories, system font paths, and a shared configuration profile (profile.json). No unauthorized network activity or transmission of sensitive local data was detected; external requests are limited to official Unicode and lexicographical databases.
[SAFE]: No signs of obfuscation, persistent access mechanisms, or privilege escalation were found. The skill maintains a clear separation between factual lexicographical data and visual interpretations through its structured research standard.

lovstudio-hanzi-lens