The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as series names and category labels from CSVs or API responses, for rendering in charts, tooltips, and legends.
Ingestion points: Data labels and category names processed in references/interaction.md and references/marks-and-anatomy.md.
Boundary markers: The instructions in references/interaction.md explicitly warn that labels are untrusted data.
Capability inventory: The skill generates HTML/React artifacts and executes local validation scripts via subprocess calls (node scripts/validate_palette.js).
Sanitization: The skill provides high-quality security guidance, instructing the agent to use textContent or createTextNode instead of innerHTML to prevent XSS and injection when interpolating labels.
[COMMAND_EXECUTION]: The skill requires the execution of a provided local script (scripts/validate_palette.js or scripts/validate_palette.py) to perform complex color validation calculations.
Evidence: node scripts/validate_palette.js "<hex,hex,...>" --mode light as described in SKILL.md and references/color-formula.md.

dataviz