The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from financial documents (PDF, CSV, JSON). \n- Ingestion points: scripts/extract_pdf_data.py (PDF) and scripts/analyze_finances.py (CSV/JSON). \n- Boundary markers: The skill does not implement specific delimiters or instructions for the agent to ignore potentially malicious commands embedded in the transaction data. \n- Capability inventory: The skill scripts perform file system read and write operations but do not possess network access or arbitrary shell execution capabilities. \n- Sanitization: While the scripts validate numeric and date fields, the transaction descriptions are extracted as raw strings, which could allow for indirect prompt injection or cross-site scripting (XSS) in the generated HTML reports. \n- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of pandas and pdfplumber via pip. Additionally, the HTML report generator (scripts/generate_report.py) references the Chart.js library from the cdn.jsdelivr.net content delivery network, which is a well-known and trusted service.

finance-manager