The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/build_course.py file uses subprocess.run to execute ffprobe for validating video duration and stream metadata. This is a legitimate functional requirement. The script mitigates risks by resolving the executable path via shutil.which and validating the target file path through a safe_file function that prohibits parent directory traversal, absolute paths, and symlinks.
[SAFE]: The skill implements strong protection against cross-site scripting (XSS) by using html.escape across its rendering engine (e.g., scripts/app_shell.py, scripts/render_page.py, and scripts/build_course.py). This ensures that user-provided learning materials are safely converted to HTML entities before being embedded in the final course package.
[SAFE]: File management is restricted to authorized project subdirectories. The artifact-paths.md reference defines strict ownership and Git-based exclusion checks, ensuring the tool does not interfere with sensitive configuration files or external repository paths.

tk-course