The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the official @tanstack/charts package and its framework-specific peers (React, Vue, Solid, etc.) using bun. It also references documentation from established domains including tanstack.com and the official repository at github.com/TanStack/charts for version 0.14.0. These are well-known and expected resources for this technology.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data structures (typically an array of objects referred to as rows or alphabet) to generate chart configurations and scenes. This ingestion of untrusted external data creates a potential surface for indirect prompt injection attacks if malicious instructions are embedded within data labels or values.
Ingestion points: Data is passed into chart definitions and React components as the rows prop in references/frameworks-interaction.md and as arguments to barY or lineY in references/setup-core.md and references/transforms-layouts.md.
Boundary markers: The instructions do not define specific delimiters or warnings to the agent to ignore instructions embedded within the processed data rows.
Capability inventory: The skill is restricted to generating visualization code and documentation. No dangerous capabilities such as arbitrary shell command execution, file system writes, or network exfiltration of ingested data were identified.
Sanitization: There is no explicit mention of sanitizing or escaping the user-provided data before it is interpolated into the chart scene or accessibility labels (ariaLabel).

tanstack-charts