The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script scripts/render_report.py and the Node.js script scripts/export_report_png.js execute the resvg command-line tool. This utility is used to render SVG artifacts into PNG format. The calls are implemented securely using argument lists rather than raw shell strings, which effectively mitigates command injection risks.
[PROMPT_INJECTION]: The skill is designed to process external search results, which introduces a surface for indirect prompt injection. However, the skill provides extensive documentation in references/research-thinking.md and references/source-quality.md that instructs the agent to separate evidence from inference, cross-check sources, and mark uncertainty. These instructions serve as functional guardrails to ensure the agent maintains a critical posture toward external data.
[DATA_EXFILTRATION]: The skill recommends embedding images as base64 strings within the SVG reports. This is a legitimate functional requirement for creating self-contained, portable artifacts and does not represent a data exfiltration threat in the context of the skill's research-oriented purpose.

research-studio