The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes two Python scripts (scripts/fits_audit.py and scripts/image_stats_preview.py) intended for local execution. These scripts are designed to read FITS headers and image statistics, respectively. Analysis of the source code confirms they use standard libraries and do not contain arbitrary command execution or shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The Python scripts reference standard scientific libraries (astropy and pillow). While the scripts suggest installing these via pip if missing, there are no automated or hidden remote code execution patterns or downloads from untrusted sources.
[DATA_EXFILTRATION]: The skill involves reading local file metadata (FITS headers and image attributes). However, there are no network operations, API calls, or data exfiltration patterns detected. All processing results and previews are stored locally in user-defined directories (process/ or exports/).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process metadata from external files (FITS/RAW/XISF). While this technically introduces an attack surface where malicious instructions could be embedded in file headers (e.g., the 'OBJECT' field), the skill's instructions focus on technical diagnosis and diagnostic summary, reducing the risk of unintended instruction following. This is a standard risk for any metadata-parsing tool.

astrophotography-processing