The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's core workflow involves the agent dynamically generating and executing Python scripts (utilizing matplotlib and seaborn) to produce research figures. This behavior is fundamental to the skill's intended purpose of data visualization but represents an inherent risk surface for runtime code execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from CSV, Excel, and Markdown files to populate figure labels, captions, and parameters. Maliciously crafted data could potentially influence agent behavior during the generation and self-critique loop.
Ingestion points: Identified in SKILL.md (Step 1) and scripts/fill_prisma_template.py where external counts and text are processed.
Boundary markers: The skill includes high-level instructions to verify data for Protected Health Information (PHI) but lacks robust sanitization or strict delimiters for data interpolated into generated scripts.
Capability inventory: File writing, execution of generated Python/R scripts, and subprocess calls to external binaries.
Sanitization: No explicit sanitization of strings used as labels or caption text.
[COMMAND_EXECUTION]: The script scripts/generate_visual_abstract.py executes the soffice (LibreOffice) binary via subprocess.run to perform PowerPoint to PNG conversions. This is a legitimate functional requirement for exporting visual abstracts.
[EXTERNAL_DOWNLOADS]: The script scripts/fetch_official_templates.sh fetches research templates from established organizations including prismastatement.org, consort-spirit.org, and equator-network.org. These domains are recognized as well-known sources for clinical reporting guidelines.

make-figures