The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by having the agent execute Python scripts from the scripts/ directory. The documented workflow involves copying a script template, manually replacing a data block with user-supplied values, and then running the modified script using the python interpreter. This pattern of dynamic script modification and execution is a known capability that can be abused.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted user data (such as figure labels, titles, and numerical values) and interpolates them directly into executable code templates without any sanitization or validation instructions.
Ingestion points: User-provided data for plot labels, titles, and data points enter the agent's context during the figure generation process as described in references/modes/from-data.md and references/modes/from-image.md.
Boundary markers: None. The skill does not provide any guidance or markers to the agent to distinguish between code logic and untrusted data strings during the script modification phase.
Capability inventory: The agent can write to the local file system via plt.savefig() and execute arbitrary Python code through the python command line tool.
Sanitization: None. The skill's instructions and the provided Python templates lack any logic to escape or validate user-provided strings before they are executed as part of a Python script.

paper-plot