The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary workflow (Phase 4) requires the agent to dynamically generate a Python script named generate_techmap.py and execute it to produce SVG visualizations via the Graphviz library. This represents dynamic code generation and execution at runtime.
[DATA_EXFILTRATION]: Example scripts included with the skill (e.g., generate_techmap_v4.py) contain hardcoded absolute file paths pointing to C:\Users\lenovo\..., which exposes the author's local username and internal directory structure.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to external services, specifically querying the Wikidata SPARQL endpoint (query.wikidata.org) and installing dependencies like graphviz and requests. These are well-known services and packages used for their intended research purposes.
[PROMPT_INJECTION]: The skill processes data from web searches and external databases to populate its technical mapping. This creates a surface for indirect prompt injection where malicious content found online could potentially influence the behavior of the generated visualization script.
Ingestion points: tavily-search results, search_web output, and Wikidata SPARQL bindings in wikidata_client.py.
Boundary markers: None explicitly enforced for external data interpolation.
Capability inventory: File writing, Python execution, and network access.
Sanitization: The skill implements _escape_sparql in scripts/wikidata_client.py to prevent query injection, but lacks equivalent sanitization for incoming external data before it is written into visualization scripts.

technology-mapping