The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user to install standard development packages like react, @react-pdf/renderer, and tsx. These are well-known, legitimate packages for the stated purpose of PDF generation and TypeScript execution.
[COMMAND_EXECUTION]: The skill uses pdftoppm and pip install pymupdf for PDF-to-image conversion. These are standard utility tools for visual inspection of documents.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading Google Fonts via curl using URLs found in a local reference file. This is a common development task for embedding custom typography in documents and does not involve executing remote code.
[DYNAMIC_EXECUTION]: The skill uses tsx to run TypeScript files. tsx is a standard runtime for executing TypeScript and JSX in Node.js environments, and the usage described is consistent with its intended purpose.
[DATA_EXPOSURE]: The skill focuses on local file generation and does not contain patterns for accessing sensitive system files or exfiltrating data to remote servers. All file operations (renderToFile) are directed to local paths (e.g., ./output.pdf).

react-pdf