The Agent Skills Directory

[SAFE]: The skill demonstrates strong security awareness by explicitly requiring the use of textContent and document.createElement instead of innerHTML when processing user-provided data (CSV, JSON, logs). This effectively mitigates the risk of Cross-Site Scripting (XSS) from malicious data payloads.
[SAFE]: It promotes a self-contained architecture by mandating that data be embedded directly into the generated HTML file, which prevents unauthorized data exfiltration via external fetch calls.
[SAFE]: The skill restricts external resources to well-known and trusted services, such as Google Fonts and established charting libraries (e.g., Chart.js, D3) from CDNs, which are standard for web-based visualizations and pose minimal risk.
[SAFE]: It explicitly forbids the use of persistent browser storage mechanisms like localStorage or IndexedDB, ensuring that generated artifacts remain ephemeral and comply with platform security constraints.
[SAFE]: Regarding potential indirect prompt injection surfaces, the skill ingests untrusted datasets (ingestion point: SKILL.md) but implements clear sanitization requirements (capability: file-write, sanitization: safe DOM APIs) and lacks high-privilege capabilities that could be exploited by embedded instructions.

html-data-explorer