The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/render_report.py script uses subprocess.run to execute the tally.py validation tool and system commands such as open or xdg-open to launch a web browser.
[DATA_EXFILTRATION]: The skill intentionally displays full file:// URIs in its output for user convenience. This exposes the user's local directory structure and system username to the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill processes markdown content to generate HTML reports, which constitutes a vulnerability surface for processing untrusted data.
Ingestion points: scripts/render_report.py reads markdown files specified by the user or agent.
Boundary markers: No specific boundary markers or 'ignore' instructions are provided to the agent for the processed content.
Capability inventory: Subprocess execution, filesystem writing, and external browser invocation are present in scripts/render_report.py.
Sanitization: The script employs html.escape during the HTML generation process to mitigate simple injection attacks.
[DYNAMIC_EXECUTION]: The function find_tally in scripts/render_report.py dynamically resolves the location of the tally.py dependency by checking several computed paths on the filesystem at runtime and executes it using sys.executable.

report-card