The Agent Skills Directory

[SAFE]: The skill implements a multi-layered security model to handle untrusted, model-written SQL queries. This includes a SQL allowlist guard that analyzes the query AST to permit only declared data sources and safe table functions, a locked-down DuckDB connection that restricts file system access to specific allowed paths, disables external network access, and locks the database configuration, and automatic scrubbing of secrets from error messages and result data. * [SAFE]: The dashboard generation process uses a secure rendering pipeline where the resulting HTML dashboards operate offline under a strict Content Security Policy (CSP) that prohibits external data fetching and unsafe-eval. * [SAFE]: Dependency management is handled via a doctor utility that identifies missing requirements and provides fix commands for the user to review and execute. Automated fixes are limited to non-privileged commands like npm ci, and instructions explicitly require user consent. * [SAFE]: Static analysis flags regarding Unicode characters were investigated and determined to be benign security measures. The identified characters (U+2028 and U+2029) are explicitly handled to ensure JSON data is safely embedded within HTML script tags, preventing potential script termination issues.

make-dashboard