The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from CSV files and processes it to generate visualization configurations, creating a potential surface for indirect prompt injection if the output is later re-processed by an agent.
Ingestion points: The scripts/main.py script reads external data from a CSV file specified via the --data argument.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the ingested CSV data.
Capability inventory: The skill has the capability to write files to the local file system using Path.write_text and execute external commands via subprocess.run in scripts/main.py.
Sanitization: Data from the CSV columns is interpolated directly into configuration and data files without escaping or sanitization.
[COMMAND_EXECUTION]: The skill invokes the external 'circos' command-line tool to render plots, which is a standard execution capability.
Evidence: In scripts/main.py, the subprocess.run function is used to execute ["circos", "-conf", config_path] when the --render flag is provided.
Input control: The command is executed using the list format (shell=False by default), which mitigates shell injection risks, although it depends on the integrity of the external environment where 'circos' is installed.

circos-plot-generator