The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its image processing pipeline. When the AI model extracts text from a figure, the resulting strings (e.g., titles, legend text, notes) are rendered in the web UI using .innerHTML in web/app.js without sanitization, creating a Cross-Site Scripting (XSS) vulnerability.
Ingestion points: Image files (PNG, JPG, TIFF) uploaded by the user are processed by Claude vision in web/server.py via extract_image_region.
Boundary markers: Absent; the logic assumes the LLM output is benign text, but it is rendered as HTML.
Capability inventory: The web UI can execute JavaScript and make network requests; the backend calls the Anthropic API and exports results to the local filesystem.
Sanitization: Absent; the frontend logic in web/app.js (specifically the _buildResultHtml function) directly interpolates result.title, result.notes, and result.x_label into the document object model (DOM).
[DATA_EXFILTRATION]: The FastAPI server configuration in web/server.py mounts the entire web/ directory as a static file route (/static). This exposure allows any network user to access the application's own source code, including server.py and app.js.
[COMMAND_EXECUTION]: The web/server.py script configures the web server to listen on 0.0.0.0, making the extraction tool and any uploaded images accessible to any device on the local network.
[EXTERNAL_DOWNLOADS]: The skill's frontend (web/index.html) fetches the Tailwind CSS framework from a well-known service (cdn.tailwindcss.com) at runtime.

data-extractor