The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess module in scripts/ab_test_stats.py and scripts/check_prerequisites.py to check for the presence of the ae-cli tool and to manage a private virtual environment for Python dependencies like scipy and numpy. These operations are limited to environment verification and dependency management for the skill's primary analytical purpose.
[REMOTE_CODE_EXECUTION]: The skill implements an automated installation of standard scientific libraries (scipy, numpy) into a private virtual environment using pip if they are missing from the system. This is a common pattern for analytical tools to ensure statistical functions are available and does not involve downloading arbitrary or untrusted scripts.
[DATA_EXPOSURE]: The skill interacts with the ae-cli tool to read experiment metadata and run ad-hoc queries on a project. It explicitly follows a read-only access model for project data and does not hardcode or exfiltrate credentials. Sensitive paths (like SSH or AWS keys) are not accessed.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted experiment data (column names, metric values) from the analytics platform. It mitigates injection risks by converting metric values to numbers (int/float) before processing and by escaping all strings (experiment names, hypothesis text, metric names) before they are rendered into the final HTML report using a dedicated _e() escaping function in scripts/generate_report.py.
[OBFUSCATION]: Analysis of scripts/ab_test_stats.py shows that statistical constants (coefficients for Acklam inverse-normal approximation) are stored using float.fromhex() to ensure cross-platform precision and avoid triggering false positives in scanners that flag long runs of digits as IDs. This is a defensive coding practice rather than malicious obfuscation.

ab-test-analysis