The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It ingests data from external sources, specifically CSV/Parquet files and user-provided PNG images, and interpolates content from these files directly into prompts for the agent's panel generation and review tasks.
Ingestion points: derive_outline_prompt (reads PNG pixels), panel_task (incorporates data_path and claim from the outline), and composite_review_task (spot-checks plotted values against CSV files).
Boundary markers: While the generated prompts use markdown headers for structure, they lack explicit 'ignore embedded instructions' delimiters for the interpolated data fields.
Capability inventory: The skill utilizes image manipulation via PIL and matplotlib, file system reads/writes for PNGs, and prompt interpolation. It does not possess network access.
Sanitization: There is no evidence of sanitization or filtering for external content (like claims or messages) before they are placed into instructions.
[COMMAND_EXECUTION]: The skill requires the user to execute its core logic via exec(open("figure-composer/kernel.py").read()). While this is a common pattern for loading agent skills in certain environments, it involves the execution of local scripts which could be targeted if the skill directory is compromised.

figure-composer