The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/slide-token-validator.py and the test file scripts/tests/test_validate_tokens.py utilize subprocess.run() to execute local Python and Node.js scripts. This is part of the skill's internal orchestration (wrapping the HTML validator) and regression testing suite. The command construction uses absolute or resolved paths and does not utilize shell=True, minimizing risks of command injection.
[EXTERNAL_DOWNLOADS]: The skill references external assets from well-known and trusted providers. It loads Chart.js from cdn.jsdelivr.net and typography from fonts.googleapis.com. Additionally, scripts/fetch-background.py provides curated image URLs from Pexels and Unsplash for use as slide backgrounds. These references are documented and align with the primary purpose of the skill.
[INDIRECT_PROMPT_INJECTION]: The scripts/generate-slide.py script ingests user-supplied content and URLs to generate HTML slides. To mitigate injection risks, it implements a robust sanitization layer including _e() for HTML escaping and _safe_url() to validate URI schemes, preventing javascript: URI injection (CWE-79).
[SAFE]: The design token system follows best practices by centralizing raw values in primitives and referencing them through semantic aliases. This architecture reduces the risk of accidental exposure or inconsistency by maintaining a single source of truth for the brand's visual identity.

design-system