The Agent Skills Directory

[COMMAND_EXECUTION]: The file references/report-templates.md contains Python implementation patterns (_evaluate_condition and evaluate_section_visibility) that utilize the eval() function to process runtime conditions within report templates. Using eval() on data that could be influenced by untrusted sources creates a critical risk of arbitrary code execution.
[COMMAND_EXECUTION]: The implementation of Puppeteer in SKILL.md and references/pdf-generation.md includes the use of high-risk flags such as --no-sandbox and --disable-setuid-sandbox. These flags disable the browser's primary security isolation mechanisms, increasing the impact of potential vulnerabilities during the rendering of complex HTML/CSS.
[EXTERNAL_DOWNLOADS]: The skill relies on external binaries and packages for its core functionality, specifically Puppeteer (which downloads Chromium at runtime) and wkhtmltopdf (which requires a system-level binary). It also references a non-standard or potentially mistyped package csv-writers in code examples, which could lead to supply chain risks.
[PROMPT_INJECTION]: The SKILL.md file contains explicit behavioral constraints for the AI agent, such as 'Compress output' and 'No explanations'. While intended for efficiency, these instructions can be used to minimize output transparency and reduce user oversight of generated code or commands.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large datasets from databases to generate reports.
Ingestion points: Data enters the context via the fetchDataBatches function in SKILL.md and database queries in references/excel-csv-export.md.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this ingested data as untrusted content.
Capability inventory: The skill possesses capabilities for browser automation (Puppeteer), database querying, file system writes, and network operations (Bull queue, SMTP).
Sanitization: While the skill documentation mentions using DOMPurify and template variables, the core implementation remains vulnerable to indirect injection if the data processed contains malicious markdown or control characters that influence the template engine or downstream processing.

backend-report-generation