The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/explode.py uses importlib.util.module_from_spec and spec.loader.exec_module to dynamically load and execute code from model files provided at runtime.
[COMMAND_EXECUTION]: The scripts/profiles.py script invokes subprocess.run to execute shell commands for installing dependencies.
Evidence: subprocess.run([sys.executable, '-m', 'pip', 'install', '-q', 'svgelements']) in svg_polylines function.
[EXTERNAL_DOWNLOADS]: The skill attempts to download and install the svgelements package from the Python Package Index (PyPI) at runtime if it is not already present in the environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data sources, including PDF vectors, SVG paths, and raster images, which could be crafted to exploit vulnerabilities in underlying parsing libraries like pymupdf or opencv-python.
Ingestion points: pdf_polylines, svg_polylines, and raster_outlines functions in scripts/profiles.py.
Boundary markers: None identified; content is processed directly for coordinate extraction.
Capability inventory: The skill has the ability to write files to the workspace, execute shell commands (via subprocess), and execute arbitrary Python code (via importlib).
Sanitization: Basic geometric checks (like area minimums) are performed, but there is no structural validation of the incoming binary or XML-based formats.

exploded-teardown