The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a standalone Python script (toolkit/scripts/analyze.py) for geospatial computations. The documentation provides clear instructions for the operator to execute this script manually in an isolated environment, ensuring no automated or hidden execution occurs during skill loading.
[EXTERNAL_DOWNLOADS]: The documentation identifies standard, well-known geospatial dependencies (shapely and pyproj) that the user should install. It does not attempt to automate these downloads or pull from untrusted repositories.
[INDIRECT_PROMPT_INJECTION]: The analyze.py script processes untrusted GeoJSON data. It implements defensive programming measures such as JSON nesting depth limits, strict coordinate validation, and a byte-budgeting system for outputs to prevent resource exhaustion or malformed data attacks.
[SAFE]: The Python script explicitly disables network access for the pyproj library, mitigating risks of unintentional data exfiltration via network-enabled coordinate transformation features.
[SAFE]: The tool includes localized path safety logic that blocks directory traversal and restricts symlink usage to a set of verified system defaults on macOS, protecting against local file inclusion or unauthorized access through the file system.

omh-geospatial-analysis