The Agent Skills Directory

[SAFE]: The skill executes Pareto calculations and chart generation entirely through local Python scripts, requiring no network connectivity or external dependencies.
[SAFE]: All scripts within the scripts/ directory implement path validation via a _validate_path function, which prevents directory traversal attacks by resolving real paths and checking for parent directory references (..).
[SAFE]: The generate_report.py script mitigates Cross-Site Scripting (XSS) vulnerabilities by utilizing the html.escape module to sanitize all user-provided fields (such as category names, analyst name, and notes) before they are interpolated into the generated HTML report.
[INDIRECT_PROMPT_INJECTION]: The skill's instructions in SKILL.md proactively address potential data-driven attacks by directing the agent to treat all user-provided text as data rather than directives, providing a clear boundary for processing untrusted inputs.
[COMMAND_EXECUTION]: The use of the Bash tool is restricted to running the included local Python scripts for data analysis and visualization, with no evidence of unsafe command construction or shell injection vulnerabilities.

pareto-analysis