The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_market_visuals.py uses subprocess.run() to invoke other local utility scripts (generate_schematic.py and generate_image.py). The commands are constructed using lists rather than raw strings and do not use shell=True, which follows security best practices for executing local processes.
[INDIRECT_PROMPT_INJECTION]: The skill relies on the research-lookup tool to ingest data from external web sources. This content is then used to populate report sections and generate prompts for visualizations.
Ingestion points: External data is fetched via research-lookup calls described in SKILL.md (e.g., in the 'Deep Research' phase).
Boundary markers: The instructions do not define specific delimiters or 'ignore' instructions for the data processed from the research tool.
Capability inventory: The skill has access to file writing and command execution (via Bash and subprocess.run in scripts/generate_market_visuals.py).
Sanitization: There is no evidence of explicit sanitization or validation of the text retrieved from external lookups before it is interpolated into LaTeX templates or shell command arguments.
[DYNAMIC_EXECUTION]: The scripts/generate_market_visuals.py script dynamically builds command-line arguments using string formatting (e.g., injecting the {topic} variable into prompt templates). While these commands are executed locally as part of the skill's primary reporting function, they represent a dynamic execution pattern.

market-research-reports