The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_doc.py utilizes the subprocess module to invoke a local web browser (Edge, Chrome, or Chromium) in headless mode. This is a legitimate function used to convert the generated HTML documentation into PDF format. The script safely constructs the command using a list of arguments, avoiding shell interpolation risks.
[EXTERNAL_DOWNLOADS]: The HTML template in scripts/render_doc.py references external JavaScript libraries (marked.js and mermaid.js) from the well-known cdn.jsdelivr.net content delivery network. These libraries are used for client-side Markdown parsing and diagram rendering respectively.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process user-provided briefs and requirement files, which constitutes a surface for indirect prompt injection. However, the skill implements robust mitigations, including a 'Source-or-TBD' rule and a mechanical provenance checker (scripts/check_doc_provenance.py) that ensures every numeric fact in the output can be traced back to the source input or the validated model.
Ingestion points: Ingests project briefs and requirement text from files or conversation context to populate sa-model.yaml.
Boundary markers: The workflow requires a validated YAML model as an intermediate step, creating a structural boundary between raw input and final document generation.
Capability inventory: File system writes (to the project directory), subprocess execution (browser for PDF), and reading project files.
Sanitization: The skill uses yaml.safe_load for parsing the model and employs a provenance gate to flag any data in the final document not present in the audited source.

sa-doc