The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as image files (SVG, PDF, TIFF) and publisher profile JSON files. This represents a potential surface for indirect prompt injection if an attacker-controlled file contains malicious instructions. \n
Ingestion points: scripts/image_metadata.py (reads images), scripts/export_plan.py (reads JSON profiles), and figure_export.py (writes manifests based on data). \n
Boundary markers: The instructions in references/publication_guidelines.md advise agents to verify integrity and ignore deceptive encodings, though explicit prompt delimiters for runtime data are not consistently applied. \n
Capability inventory: The skill can write files to the local system and execute local Python scripts via uv run. \n
Sanitization: The skill implements significant mitigations, including MAX_INPUT_BYTES limits, symlink rejection in scripts/_common.py, XXE entity blocking in SVG parsing, and decompression bomb protection for raster images in scripts/image_metadata.py.\n- [DYNAMIC_EXECUTION]: Several scripts use dynamic loading to access bundled assets. \n
Evidence: scripts/style_presets.py and scripts/palette_audit.py use importlib.util.spec_from_file_location to load assets/color_palettes.py. The path is derived from the script's own location (__file__) and is not influenced by external input, posing minimal risk.\n- [EXTERNAL_DOWNLOADS]: The skill documentation encourages the use of uv run with pinned dependencies from the Python Package Index (PyPI). \n
Evidence: SKILL.md and references/matplotlib_examples.md include shell commands that install packages like matplotlib, seaborn, and plotly at runtime. These are well-known, reputable scientific libraries fetched from an established registry.

scientific-visualization