The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/render_mermaid.py script is capable of downloading the @mermaid-js/mermaid-cli package from the NPM registry using the npx utility if the tool is not found locally. This targets an official package from a well-known service for diagram rendering.\n- [COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.check_output in scripts/render_mermaid.py to execute system tools like mmdc, npx, and wslpath. These executions are implemented using argument lists, which is a secure practice that prevents shell-based command injection.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources to generate reports, creating an indirect prompt injection surface.\n
Ingestion points: Vulnerability finding data is ingested from external systems such as finding-tracker, triage-verifier, and auto-triage as described in the workflow section of SKILL.md.\n
Boundary markers: The skill uses structured Markdown headers (e.g., ## Summary, ## Steps To Reproduce) in scripts/report_template.py to delimit different sections of the generated report.\n
Capability inventory: The skill possesses capabilities to write files to the local file system via scripts/report_template.py and execute shell commands via scripts/render_mermaid.py.\n
Sanitization: Path sanitization is performed using the slug() function in scripts/report_template.py to prevent path traversal, though the content of the findings is interpolated into the report template without specific escaping or filtering.

report-writer