The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute the open command on macOS. This is used solely to open the generated HTML preview galleries or 3D tunnels in the user's default browser. The command is called with a list of arguments and does not use a shell, preventing shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill searches for and downloads images and metadata from 15 established and reputable external sources, including NASA, the Metropolitan Museum of Art, Wikimedia Commons, and the Smithsonian. These network operations are necessary for the skill's primary functionality and target official API endpoints.
[DYNAMIC_EXECUTION]: The skill utilizes importlib.import_module in its source registry to load specific image provider modules. This loading is restricted to a hardcoded internal dictionary. Additionally, several scripts use __import__ for local path manipulation to ensure sibling modules are correctly located during execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes image metadata (such as titles and tags) from external search results. It implements security measures like HTML escaping (html.escape) and proper JSON serialization (json.dumps) when rendering this metadata into preview files, effectively mitigating risks of cross-site scripting (XSS) or browser-based injection.
[CREDENTIALS_UNSAFE]: The skill manages API keys for optional third-party services by reading them from a dedicated local configuration file at ~/.config/env/secrets.env. This is a recommended practice for secure secret management within this agent platform.

image-well