The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/validate_js.py uses subprocess.run to invoke the node --check command. This is a static analysis feature used to verify the syntax of generated JavaScript fragments before delivery. Because it uses the --check flag, Node.js parses the script for syntax errors without executing any logic, significantly limiting risk.
[DYNAMIC_EXECUTION]: The script build-html/scripts/prepare_story_head.py utilizes importlib.util to dynamically load local utility modules (embed_css.py and preset_resolver.py). This is a controlled internal mechanism used for build-time configuration and does not involve loading untrusted or remote code.
[INDIRECT_PROMPT_INJECTION]: As a data processing tool, the skill ingests external datasets (dataset_map.json) and user-provided story plans. To mitigate the risk of malicious data being used to inject scripts into the output, the skill implements a strict security gate in scripts/normalize_story_assets.py. This validator blocks <script> tags, on* event handlers, javascript: URLs, and foreignObject tags in SVG assets. Additionally, scripts/compose_story.py uses html.escape for text interpolation.
[EXTERNAL_DOWNLOADS]: The generated output references visualization and animation libraries from the official VisActor and GSAP repositories via unpkg.com. These are well-known, established services used for legitimate visualization tasks and do not represent a data exfiltration or malware risk in this context.

data-storytelling