The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill relies on standard, well-known Node.js packages (vega, vega-lite, and sharp) from the official NPM registry. These are legitimate tools for data visualization and image rendering.
[COMMAND_EXECUTION]: The skill uses a Node.js script (chart.mjs) to perform its tasks. The agent instructions in SKILL.md and CAPABILITY.md describe how to invoke this script via the shell. This is the intended and necessary method for the skill to function within the agent environment. User-provided data is intended to be passed as JSON strings, which the script parses safely using JSON.parse().
[DATA_EXFILTRATION]: No network operations or data exfiltration patterns were detected. The skill documentation explicitly states it is designed for offline use and does not require external API calls.
[PROMPT_INJECTION]: The instructions in SKILL.md are purely functional, guiding the agent on how to correctly format data, call the generation script, and send the resulting file to the user. No attempts to override safety filters or bypass system instructions were found.
[DYNAMIC_EXECUTION]: The skill processes structured JSON data and compiles Vega-Lite specifications into SVG/PNG. This is a standard data transformation process and does not involve the execution of arbitrary code via eval() or similar dangerous functions.

chart-gen