The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to run local Python scripts for QR code generation and profile management as part of its primary workflow. A subprocess.run call is used within the test suite (tests/test_create_qrcode.py) to execute the skill's CLI for validation, using the current Python interpreter and a list of arguments, which is a safe and standard testing practice.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input (text or URLs) to generate QR codes, which represents a potential surface for indirect prompt injection if downstream agents were to process the resulting image's content without safeguards. The skill mitigates this by providing an optional but encouraged scan-verification mode (--verify scan) using OpenCV to ensure the generated QR code matches the input exactly, and its documentation explicitly warns against encoding malicious destinations.
Ingestion points: scripts/create_qrcode.py via positional arguments, stdin, or input files.
Boundary markers: Skill instructions emphasize avoiding shell history and profile persistence for sensitive payloads.
Capability inventory: Local file system operations including reading files (Path.read_text), writing images (Image.save), and atomic profile updates with restricted permissions.
Sanitization: Input content is treated as UTF-8 data and encoded into a standard QR matrix; verification ensures high-fidelity output.

lov-create-qrcode