The Agent Skills Directory

[COMMAND_EXECUTION]: The shared core library in _shared/eml_core/viz.py utilizes subprocess.run to call the Graphviz dot utility for generating SVG visualizations. This implementation is secure as it uses a fixed argument list (["dot", "-Tsvg"]) and avoids shell=True. The input provided to the binary is a Graphviz DSL string programmatically generated from a highly restricted mathematical AST (limited to symbols '1', 'x', 'y' and the 'eml' operator). User-provided titles are escaped using a dedicated _dot_str helper to prevent injection attacks.
[DATA_EXFILTRATION]: The skill processes user-provided CSV data via --csv. The ingestion logic in _shared/eml_core/fit.py employs strict validation, ensuring that all input cells are parsed as numeric complex values. Any non-numeric data, such as scripts or natural language instructions, will trigger a FitError and terminate execution, effectively preventing the skill from being used to leak sensitive text or process malicious instructions embedded in data files.
[REMOTE_CODE_EXECUTION]: The _shared/eml_core/compile.py module uses sympy.parse_expr to compile mathematical formulas into internal tree structures. This usage is safely constrained by a restricted local_dict that only includes approved mathematical functions and symbols, preventing the evaluation of arbitrary Python code through the formula input.

eml-fit