The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries via subprocess.run in scripts/render_schematic.py. Specifically, it runs the drawio command. The path to this binary is configurable via renderer.drawio.cli_path in config.yaml or config_local.yaml. Although the script verifies the file's existence, this mechanism allows an attacker who can modify the configuration to execute arbitrary binaries present on the system.
[DATA_EXFILTRATION]: In the 'Nano Banana' mode, the skill communicates with the Gemini API. The base URL for these requests is configurable via the GEMINI_BASE_URL environment variable. If an attacker directs this to a malicious endpoint, the GEMINI_API_KEY (also loaded from the environment) would be transmitted to that untrusted server during API calls or connectivity checks.
[EXTERNAL_DOWNLOADS]: The skill can trigger the installation of the drawio desktop application using Homebrew on macOS if the auto_install_macos setting is enabled. It also downloads generated image data from the configured Gemini API endpoint.
[PROMPT_INJECTION]: The skill processes untrusted LaTeX (.tex) files to extract research terms and plan schematic structures (Category 8). This represents a significant attack surface where maliciously crafted LaTeX content could influence the AI agent's planning and generation phases, potentially bypassing intended constraints or manipulating the output spec.
[SAFE]: The skill implements consistent path safety checks using is_safe_relative_path to prevent directory traversal when accessing local resources like color palettes and template models.

nsfc-schematic