The Agent Skills Directory

[COMMAND_EXECUTION]: The Python and Node.js scripts (read_csv.py, read_excel.py, html2pptx.js) utilize subprocess.check_call and spawnSync to execute shell commands.
These commands are used to invoke pip and npm for package installation.
[EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs external packages from public registries (PyPI and npm) if they are not present in the environment.
Packages include pandas, openpyxl, tabulate, chardet, puppeteer, and pptxgenjs.
HTML reports reference external CDN resources such as ECharts and Google Fonts for rendering visualizations.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes untrusted content from user-supplied data files which is then used to prompt subagents.
Ingestion points: User-provided CSV and Excel files are parsed by read_csv.py and read_excel.py and passed to analytical workflows.
Boundary markers: The instructions do not employ specific delimiters or "ignore embedded instructions" warnings when passing data to the parallel analyst subagents.
Capability inventory: The skill can spawn background subagents via the Task tool, write report files to the disk, and use Puppeteer for headless browser operations.
Sanitization: There is no evidence of sanitization or filtering applied to the data values before they are integrated into the synthesis prompts.

data-analysis-pro