The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/md2img.py and scripts/md_to_image.py utilize the Playwright library to launch an automated Chromium browser instance. This is the intended behavior for rendering HTML content into high-quality image files.
[EXTERNAL_DOWNLOADS]: The skill interacts with well-known external services to enrich generated posters with media metadata. It fetches YouTube thumbnails from i.ytimg.com and img.youtube.com, and retrieves video information from noembed.com. These are recognized services used for legitimate purposes within the skill's scope.
[DATA_EXPOSURE]: The scripts/md2img.py script contains a hardcoded local file path (/Users/ugreen/Documents/obsidian/attachments) used as a default output directory. While this reveals information about the developer's local environment, it does not pose a direct threat to the end user.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a processing pipeline for user-provided Markdown files. While the resulting content is rendered in a browser environment, the risk is mitigated as the final output is a static image and the rendering occurs in an automated, headless session.
Ingestion points: Markdown content read from files provided via the --file command-line argument.
Boundary markers: None present; the skill interpolates content directly into HTML templates.
Capability inventory: The skill possesses file system write capabilities (saving PNGs), network access (fetching thumbnails), and subprocess execution (launching Playwright browsers).
Sanitization: The scripts use specific regular expression patterns to convert Markdown syntax into HTML tags rather than performing full Markdown-to-HTML parsing.

markdown-to-image