The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill identifies the @negokaz/excel-mcp-server package as a prerequisite. This is an external dependency from a third-party developer that is downloaded and executed at runtime to perform Excel manipulation tasks.
[COMMAND_EXECUTION]: The skill is designed to execute external Node.js packages via npx (as scoped in the frontmatter configuration) to bridge the agent with the Excel MCP server.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. Ingestion points: Untrusted data enters the agent context through the AskUserQuestion tool in SKILL.md (e.g., company names and financial figures). Boundary markers: None are present; user inputs are directly interpolated into the execution context. Capability inventory: The skill uses Write, Edit, and Bash tools for file and system manipulation. Sanitization: While numeric validation is performed for financial ranges, there is no evidence of escaping or sanitization for text-based inputs like company names.

excel-dcf-modeler