The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/html_doc.py script uses subprocess.run to execute external tools pandoc and node. The implementation uses list-based arguments without a shell, which is a secure method for executing system commands.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the puppeteer and @mermaid-js/mermaid-cli packages from the NPM registry. These dependencies are version-locked in package.json and the script performs runtime verification of the installed versions to ensure integrity.
[SAFE]: The skill implements comprehensive protections against indirect prompt injection and XSS. Ingestion points: Markdown is processed from files or stdin. Boundary markers: The skill uses Pandoc for structured AST parsing. Capability inventory: Capabilities are restricted to controlled subprocess execution and atomic file operations. Sanitization: The rendering pipeline includes HTML escaping of raw blocks, protocol filtering for links (allowing only http, https, and mailto), and a strict allowlist for SVG elements and attributes. The generated pages also include a restrictive Content Security Policy (CSP).

html-doc