The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/publish.py file uses subprocess.run with a list of arguments to execute git commands. This approach avoids shell injection while allowing the skill to stage, commit, and push reports to the user's repository.
[EXTERNAL_DOWNLOADS]: The templates/base.html file loads several libraries from well-known CDNs (Tailwind CSS, highlight.js, Chart.js, Mermaid.js, and KaTeX). These are used to provide the "rich, interactive" features described in the skill's purpose.
[DATA_EXFILTRATION]: The skill is designed to publish data to GitHub Pages. This transmission is performed using the user's local Git environment and credentials, matching the skill's documented behavior.
[SAFE]: The Mermaid diagram configuration uses securityLevel: 'loose', which is a known risk factor for XSS if the diagram content is sourced from untrusted inputs. However, in the context of a reporting tool where the agent generates the content, this is considered a functional choice rather than a malicious one.

html-report