The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes local Python scripts (project_tool.py, dashboard_server.py) designed to manage the project lifecycle and provide a creative dashboard. These scripts are executed locally and are restricted to the user-defined workspace.
[DATA_EXPOSURE_EXFILTRATION]: The dashboard server incorporates multiple security layers to protect local data. It binds exclusively to the IPv4 loopback address (127.0.0.1) to prevent external access, validates Host and Origin headers to mitigate CSRF and DNS rebinding attacks, and utilizes a secure session token for authentication.
[REMOTE_CODE_EXECUTION]: The dashboard_server.py script uses dynamic loading via importlib to interface with project_tool.py. This is a legitimate architectural choice for modularizing the skill's local utilities and is restricted to scripts within the skill's own directory.
[SAFE]: Filesystem operations in project_tool.py employ rigorous path normalization and safety checks. The code explicitly prevents directory traversal and uses platform-specific protections (such as O_NOFOLLOW and identity verification) to defend against symlink-based attacks, ensuring project data remains within designated boundaries.

short-drama