The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/artifact_tool.py utility uses subprocess.run to invoke the local Node.js binary for artifact validation. Specifically, the node_syntax_check function leverages node -e to parse JavaScript files via new Function(). This ensures the script is syntactically valid without executing its logic, which is a standard and safe developer tool behavior.
[DATA_EXFILTRATION]: No exfiltration or unauthorized network operations were detected. The skill and its associated scripts operate exclusively on local files and browser-local storage (app.storage), with explicit instructions to keep storage data separate from the shared model data.
[PROMPT_INJECTION]: The skill proactively addresses potential injection vulnerabilities by instructing the agent to treat all external inputs (model names, properties, and event payloads) as untrusted. It mandates the use of safe DOM APIs like textContent over innerHTML for any UI generated by extensions, demonstrating a strong security posture against indirect prompt injection and XSS.

archi-online-scripts-extensions