The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches visualization libraries such as Chart.js and Mermaid from well-known and trusted content delivery networks, including cdnjs.cloudflare.com and esm.sh. These resources are essential for the skill's primary functionality of rendering interactive charts and diagrams within the agent's interface.
[DYNAMIC_EXECUTION]: The skill generates HTML, SVG, and JavaScript code at runtime based on user requests. This generated code is executed within the platform's widget renderer to provide interactive visuals. The code generation process is governed by specific design templates and security constraints (such as a CSP allowlist) defined within the skill instructions.
[INDIRECT_PROMPT_INJECTION]: The skill features an indirect prompt injection surface because it ingests untrusted user data to populate interactive widgets and 'sendPrompt' callbacks.
Ingestion points: User prompts and provided data sets intended for visualization (e.g., "show revenue chart", "visualize this architecture").
Boundary markers: Absent. The instructions do not explicitly require the agent to use delimiters or perform escaping when interpolating user-supplied strings into HTML attributes or JavaScript callbacks.
Capability inventory: The skill utilizes show_widget for UI rendering, sendPrompt for interactive chat communication, and may write standalone HTML files to the workspace in certain host environments.
Sanitization: Partial. While the instructions recommend numerical rounding (e.g., Math.round) for displayed figures, they do not specify sanitization or validation for textual input used in interactive callbacks.
[COMMAND_EXECUTION]: The documentation includes standard setup instructions recommending that users install the skill and its parent plugin using 'npx' commands from the author's public repository.

generative-ui