The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several Python scripts for local spatial data auditing (e.g., vector_inventory.py, spatial_join_audit.py). These scripts perform file system operations but utilize a centralized validation helper (scripts/_common.py) that strictly enforces local-only paths, rejects symbolic links, and prevents directory traversal.
[EXTERNAL_DOWNLOADS]: Instructions for setting up a reproducible environment utilize uv pip install with pinned versions of official geospatial libraries from PyPI. The skill also recommends fetching citation metadata from arxiv.org, a well-known academic repository.
[CREDENTIALS_UNSAFE]: The documentation provides explicit guidance on secure PostGIS connection management, advocating for the use of environment variables or secret managers and warning against embedding or logging credentials.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external geospatial vector files (GeoPackage, GeoParquet, Shapefile). While this creates a surface for indirect prompt injection from untrusted data, the bundled audit tools mitigate this risk by redacting feature data and identifiers by default before generating reports for the agent.

geopandas