The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources such as API responses, tool outputs, and CSV headers to generate chart labels, legends, and tooltips. This presents a potential surface for indirect prompt injection where malicious instructions could be embedded in the ingested data. However, the skill demonstrates strong security awareness by providing specific mitigation guidance.
Ingestion points: Untrusted data enters the agent context via external sources like CSV files and API responses used for chart labeling (documented in references/interaction.md).
Boundary markers: The instructions do not define specific prompt boundary markers, but they provide clear structural rules for data mapping.
Capability inventory: The skill generates HTML and SVG visualizations and includes local scripts (scripts/validate_palette.js, scripts/validate_palette.py) for color math. It does not perform network writes or persistent file system modifications.
Sanitization: The skill explicitly mandates sanitization in references/interaction.md, instructing the use of textContent or createTextNode instead of innerHTML when rendering series and category names to prevent injection attacks during visualization rendering.
[SAFE]: The provided Node.js and Python scripts are utility tools for color validation. They use standard libraries for mathematical calculations and color space conversions (OKLab/OKLCH) without any external dependencies, network calls, or dangerous execution patterns. The instructions focus on best practices for accessibility, layout, and brand consistency.

Data Visualization