The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were detected in the skill instructions or associated scripts.
[DATA_EXFILTRATION]: The skill includes protective measures against accidental data exposure, such as the check_export_metadata.py script which scans for embedded editable source in image exports, and a validator that identifies local file paths in diagrams to prevent path leakage.
[INDIRECT_PROMPT_INJECTION]: The generate_roadmap.py script handles external JSON input but implements robust sanitization via HTML escaping and strict schema enforcement, preventing malicious payloads from being embedded in generated diagram labels.
[COMMAND_EXECUTION]: Script operations are limited to local file processing using safe, non-dynamic Python APIs. No network-connected command execution or shell-injection vectors were observed.

nsfc-figure