The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and renders user-supplied data formats, creating a potential XSS vector.
Ingestion points: Processes CSV, Excel, and JSON data provided by the user as described in SKILL.md.
Boundary markers: No specific instructions are provided to the agent to treat data as distinct from instructions or to sanitize the content.
Capability inventory: The skill generates interactive web pages using JavaScript and HTML. The example in example.html uses .innerHTML to insert data into the table.
Sanitization: The implementation lack sanitization for data fields, which could allow malicious scripts embedded in the data to execute in the browser.
[EXTERNAL_DOWNLOADS]: The skill utilizes external libraries from established content delivery networks.
Evidence: example.html fetches chart.js from cdn.jsdelivr.net and tailwindcss from cdn.tailwindcss.com. Metadata in SKILL.md also references a GitHub repository github.com/nexu-io/html-anything as an upstream source.

data-report