The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.call within several Python scripts (e.g., batch_convert_templates.py, convert_to_csv.py) to manage format conversion workflows. These calls are implemented securely using argument lists (rather than shell strings) and use sys.executable to target internal scripts, preventing arbitrary command injection.
[DYNAMIC_EXECUTION]: Document parsing for various formats (XLSX, Docx, XMind) is handled via standard library modules and a local utility script (xlsx_reader.py). No unsafe dynamic code execution (eval/exec) or unsafe deserialization patterns were detected.
[DATA_EXPOSURE]: Analysis confirmed the absence of hardcoded credentials, sensitive file access (such as SSH keys or environment files), or network exfiltration patterns. The skill's operations are confined to local file processing.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided project context and external files to generate performance plans. This represents a standard ingestion surface for testing tools; however, the skill does not possess exploitable capabilities or unsafe interpolation patterns that would elevate the risk beyond typical usage.
[METADATA_POISONING]: All metadata fields including the name, description, and author are consistent with the skill's stated purpose, with no deceptive instructions found in the frontmatter or documentation.

performance-testing