The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves data from the S&P Global Capital IQ API to populate reports. This data is external and untrusted, creating an attack surface where malicious content embedded in financial records could attempt to influence the agent's behavior.
Ingestion points: Data ingested via financial data tools in SKILL.md (e.g., get_rounds_of_funding_info_from_transaction_ids).
Boundary markers: The skill includes a mandatory AI disclaimer footer on the output slide, but does not define delimiters or instructions for the agent to ignore instructions embedded in the ingested data.
Capability inventory: The agent has capabilities to write files (PNG, PPTX), execute Node.js code, and run shell commands (npm, python, pdftoppm).
Sanitization: There are no instructions for sanitizing or validating the content of the external financial summaries or descriptions before they are used in slide generation.
[DYNAMIC_EXECUTION]: The skill provides specific JavaScript templates for logo generation and PowerPoint assembly. The agent is instructed to generate these scripts and execute them at runtime using Node.js.
[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands for environment setup (npm install), document conversion using a headless LibreOffice script (soffice.py), and image rendering (pdftoppm).
[EXTERNAL_DOWNLOADS]: The skill triggers the installation of the simple-icons and sharp packages from the npm registry. These are standard libraries used for brand icon retrieval and image manipulation.

funding-digest