The Agent Skills Directory

[COMMAND_EXECUTION]: The hanzi_lens.py script executes local commands via subprocess.run. This functionality is used to discover system fonts using fc-list and to invoke the CLI of the required lov-professional-infographic dependency. These operations are scoped to necessary tool functionality and use a list-based argument structure to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The skill's documentation specifies the installation of well-known Python packages (fonttools, playwright) and a companion skill for rendering. These are standard dependencies for the skill's character analysis and visualization tasks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied characters which are written to project files and HTML templates. This represents an injection surface, however, the risk is mitigated by domain-specific logic:
Ingestion points: Character input is processed by the inspect and scaffold commands in hanzi_lens.py.
Boundary markers: Explicit boundary markers are not used during string interpolation, but Unicode normalization and CJK range validation are applied to the input character.
Capability inventory: The skill possesses file-writing capabilities and can execute local subprocesses.
Sanitization: The script implements an audit command that uses regex to block inappropriate content (e.g., fortune-telling or naming inferences) and requires manual human review evidence before a 'pass' status is granted.

lov-hanzi-lens