The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the mmdc (Mermaid CLI) utility via subprocess.run() in scripts/render.py. This is used to convert diagram code within the report into SVG format. The command is executed with arguments passed as a list, which prevents shell injection, but involves local process execution.
[DYNAMIC_EXECUTION]: A multi-stage rendering pipeline is used to create final reports. It employs Jinja2 for HTML templating and Playwright for A4 PDF generation, dynamically injecting LLM-generated content and user-defined profile settings into the final output.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted information from external sources (Web Search results and the QCC Business API), creating an attack surface where malicious content in the data could attempt to influence the agent's behavior.
Ingestion points: Third-party business data and search results are processed by the agent and integrated into the templates/report-skeleton.md structure.
Boundary markers: The skill relies on natural language boundaries within the report skeleton; there are no specific adversarial filtering instructions for ingested data.
Capability inventory: The skill can write files to the local system, execute the mmdc command, and perform network-based search operations.
Sanitization: Content is sanitized during the conversion from Markdown to HTML using BeautifulSoup and Jinja2 auto-escaping, which helps mitigate downstream script execution risks in the rendered documents.

industry-research-report