The Agent Skills Directory

[COMMAND_EXECUTION]: Subprocess calls identified in scripts/slide-token-validator.py and scripts/tests/test_validate_tokens.py are used to delegate validation tasks to standard adjacent scripts. These calls explicitly avoid shell execution, pass arguments via static list arrays, and pose no command injection concerns.
[INDIRECT_PROMPT_INJECTION]: The slide generator script scripts/generate-slide.py accepts structured configuration details via JSON input. It incorporates comprehensive input safety controls, including strict HTML escaping and strict protocol matching on URL fields, preventing data or template manipulation.
[DYNAMIC_EXECUTION]: Parsers and tools rely exclusively on secure standard libraries such as json and csv. There are no dynamic code evaluation vectors like eval(), exec(), or unsafe object deserialization mechanisms.
[DATA_EXFILTRATION]: No arbitrary network connections, hidden URL endpoints, credential storage, or unauthorized access to sensitive local system file paths were detected.

design-system