The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts in the scripts/ directory that are used to manage character identities, anchors, and emotions. These scripts are invoked via the command line to perform local file operations such as directory initialization, manifest updates, and asset registration. The test suite also uses subprocess.run to verify script functionality using the local Python interpreter, which is restricted to the local environment.
[DATA_EXFILTRATION]: Analysis of the scripts and instructions confirms that all data management is confined to the .white-block-comic/ directory within the user's project root. There are no network calls, hardcoded credentials, or attempts to access sensitive system locations. The scripts include path resolution and validation to prevent directory traversal.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes user-provided story content to generate comics.
Ingestion points: Story text and character descriptions provided by the user through instructions in SKILL.md workflows.
Boundary markers: The skill implements a multi-step 'identity locking' workflow that requires explicit user confirmation, providing logical boundaries for character creation.
Capability inventory: The skill has capabilities to write files (JSON, PNG, TXT) and execute local Python scripts during testing.
Sanitization: Input validation is performed using regex for identifiers and file header checks for image assets.
[SAFE]: All external references and dependencies are localized. The Python scripts are dependency-free and perform standard file I/O tasks. No indicators of persistence, privilege escalation, or malicious obfuscation were identified. The internal string checks in the test suite represent privacy best practices by ensuring internal development tags are not leaked.

create-white-block-comic