The Agent Skills Directory

[SAFE]: Indirect Prompt Injection Risk Assessment.
Ingestion points: scripts/generate_figure.py accepts a user-provided prompt for image generation. scripts/overlay_labels.py ingests label text and coordinates via CLI arguments or JSON files.
Boundary markers: The skill does not use explicit boundary markers for the prompt, but it enforces a hardcoded "no text/no labels" instruction appended to all substrate generation requests to minimize model hallucination.
Capability inventory: The skill can execute the codex CLI tool via subprocess.run (with sandbox flags) and perform local file writes for PNG and SVG images.
Sanitization: scripts/overlay_labels.py properly sanitizes input by performing XML entity escaping on all label text and using strict hexadecimal regex validation for CSS color values, effectively preventing attribute or script injection in the generated SVG files.
[COMMAND_EXECUTION]: The skill uses subprocess.run to interact with the codex command-line interface for image generation and to execute internal Python scripts for figure composition. These executions are performed using argument lists rather than raw shell strings, which significantly reduces the risk of command injection.

ai-full-figure