The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script generate_excel.py is configured to automatically detect and install the openpyxl package from the Python Package Index (PyPI) if it is not found on the system.
[COMMAND_EXECUTION]: The skill uses subprocess.check_call to execute shell commands for dependency management, specifically calling pip install. While the package name is currently hardcoded to 'openpyxl', this pattern represents a capability for arbitrary command execution if modified.
[DATA_EXFILTRATION]: The create_excel_file function in generate_excel.py returns the absolute filesystem path of the generated Excel file using os.path.abspath(filename). This behavior exposes the internal directory structure of the agent's environment to the calling process.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect injection via Excel formulas.
Ingestion points: Data provided by the user in the data parameter of create_excel_file (defined in generate_excel.py).
Boundary markers: None identified; data is written directly to spreadsheet cells.
Capability inventory: The skill has the ability to write .xlsx files to the local disk.
Sanitization: There is no validation or escaping of cell content. If a user provides a string starting with =, it will be interpreted as a formula by Excel, leading to potential CSV/Formula Injection attacks when the file is opened by a human.
[DYNAMIC_EXECUTION]: The Python script utilizes __import__ to dynamically check for the existence of the openpyxl module at runtime.

generate-excel