The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's test suite, including scripts such as test_init_project.py and test_theme_manager.py, uses subprocess.run() to invoke the skill's own management scripts using the current Python interpreter (sys.executable). This is used for automated verification of project initialization and theme switching and does not represent a shell injection risk as it targets local, known files.
[DYNAMIC_EXECUTION]: The testing framework (test_22422_canonical_identity_reference.py) utilizes importlib.util to dynamically load and validate internal Python modules. Additionally, the build_release.py script employs compileall to perform byte-compilation of the source code during the release process. These operations are restricted to the skill's own code and are standard for software development and validation workflows.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-defined photography themes and location requirements. It implements robust mitigation strategies against instruction leakage or manipulation, such as the few_shot_exclusion_set (which prevents example data from polluting runtime prompts) and Identity Lock v2 (which forces independent facial reconstruction for each panel to prevent model drift). These measures act as effective boundaries for external data ingestion.
[SAFE]: The skill demonstrates best practices for secret management and file handling, using yaml.safe_load() for parsing configuration files and localizing all file operations to a project directory specified by the user during initialization. No hardcoded credentials or unauthorized network operations were detected.

couple-photo-orchestrator