The Agent Skills Directory

[Remote Script Execution]: The skill's documentation describes installing the uv tool by piping a remote script directly to a shell (curl ... | sh or irm ... | iex). While these are the official installation methods for this well-known developer tool, the practice of executing remote content without prior inspection is a security consideration that warrants review by the operator.
[Local Security Policy Bypass]: The suggested Windows installation command includes the -ExecutionPolicy ByPass flag for PowerShell. This allows the installation script to run despite local restrictions, which is a common requirement for such tools but represents a temporary circumvention of local security controls.
[Untrusted Data Processing]: The skill extracts content from markdown files and inserts it into YAML slide templates, which represents an indirect prompt injection surface. The skill mitigates this by implementing a yaml_escape function and using double-quoted placeholders in its templates to prevent content from breaking out of intended fields.
Ingestion points: The skill reads markdown artifacts from the directory specified by the --canonical-dir argument in scripts/generate_cards.py.
Boundary markers: Content is placed within double-quoted placeholders in the YAML templates, providing a clear delimiter from the surrounding structure.
Capability inventory: The script performs file read and write operations on the local filesystem but has no network or subprocess capabilities during its core transformation logic.
Sanitization: The yaml_escape function in scripts/generate_cards.py escapes characters that could alter the YAML structure, such as backslashes, double quotes, and newlines.
[Dynamic Code Loading]: The tests/fuzz_harness.py script uses Python's importlib to dynamically load and execute the skill's main script for testing purposes. This is a standard practice for creating test harnesses and is restricted to loading the skill's own local files.

customer-card-render