The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/lida_quick_viz.py integrates the Microsoft LIDA library to automatically generate and execute Python code at runtime. This execution is driven by LLM outputs derived from natural language prompts and the analysis of user-provided CSV or JSON data files. Performing runtime execution on AI-generated code poses a risk of arbitrary code execution if the prompt or data inputs are used to influence the generated logic.
[DATA_EXFILTRATION]: The scripts scripts/fal_image.py and scripts/gemini_infographic.py implement a recursive search for .env files in the current directory and its parents to extract sensitive API keys (FAL_KEY, GEMINI_API_KEY). Accessing .env files is identified as sensitive data exposure, particularly when the search scope extends to parent directories that may contain other unrelated configuration secrets.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data files (e.g., trial_results.csv) and interpolates column headers and other metadata directly into LLM prompts within scripts/lida_quick_viz.py. This attack surface could be exploited if a maliciously crafted data file contains instructions designed to influence the LLM during the code generation phase.
[EXTERNAL_DOWNLOADS]: The skill downloads visual assets and dependencies from well-known services. Specifically, scripts/fal_image.py fetches images from Fal.ai's API endpoints (fal.run), and the HTML files in the outputs/ directory reference the Plotly CDN for JavaScript resources.
[COMMAND_EXECUTION]: The utility script scripts/convert_slides.sh and the scripts/plotly_charts.py script invoke external CLI tools such as marp-cli and kaleido to perform slide conversions and static image rendering respectively.

cardiology-visual-system