The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically loads Python configuration modules from the config/ directory at runtime based on user input. Both scripts/tag_relevant.py and scripts/generate_report.py utilize importlib.util.spec_from_file_location to load files whose names are constructed from a topic_key argument. Although the skill implements path validation to ensure files stay within the package and uses regex to restrict the input characters, this involves executing code from computed paths.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process data from external, user-supplied Excel workbooks. This content is analyzed and then rendered into a final HTML report. While the generator script applies HTML escaping to text and allowlists URL schemes to prevent injection, the ingestion of untrusted external records into the processing pipeline remains a surface for indirect prompt injection.
[OBFUSCATION]: Minor obfuscation techniques are present in the scripts. The scripts/run.sh file uses octal escape sequences with printf to handle legacy filenames containing CJK characters. Additionally, scripts/generate_report.py employs split string concatenation (e.g., "open." + "zhihuiya.com") in its internal validation logic to prevent its security scanner from matching the strings within the script's own source code.
[COMMAND_EXECUTION]: The skill includes shell scripts for installation (install.sh) and workflow execution (scripts/run.sh). These scripts perform file system operations such as moving, copying, and changing file permissions, and the installer provides an opt-in mechanism to install Python dependencies from a requirements file using pip.

create-patent-based-rd-briefing-rd