The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/gt.py uses subprocess.run and os.execve to manage its own execution environment. Specifically, it creates a local virtual environment in ~/.cache/gt-skill/venv and re-executes itself using that environment's interpreter to ensure dependencies are met. It also invokes the opencli tool for specific subcommands. All commands are executed using list-based arguments rather than shell strings, which effectively prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: Upon first execution, the skill installs the pytrends and tabulate libraries from the Python Package Index (PyPI). These are established and well-known packages used to facilitate the skill's primary functionality.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves search data and trends from Google's infrastructure and the opencli tool, which is then processed by the agent. This represents an ingestion point for external data. However, given the nature of the data (keywords and numerical heat values) and the lack of high-privilege operations associated with its output, the risk is minimal.
Ingestion points: Data retrieved via pytrends and opencli in scripts/gt.py.
Boundary markers: None identified.
Capability inventory: subprocess.run (system tool invocation), os.execve (process management), and directory creation for caching.
Sanitization: Standard list-based argument passing is used when invoking external processes.

gt