The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the vl-convert binary from the official Vega project repository on GitHub. The download process is platform-aware, pinned to version 1.9.0, and verified using hardcoded SHA-256 checksums to ensure integrity.
[COMMAND_EXECUTION]: The skill uses node:child_process.spawnSync to execute the downloaded vl-convert binary for chart rendering and PNG preview generation. It also executes unzip or tar for initial tool installation. These calls use argument arrays to mitigate shell injection risks.
[DYNAMIC_EXECUTION]: The skill generates a temporary Vega-Lite specification file (.vl.json) at runtime by merging a user-provided template with data and configuration. This generated specification is then passed to the rendering binary for execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from CSV and JSON files which are then used to generate a Markdown report containing a data table and source information.
Ingestion points: Data files passed via the --data flag in scripts/creating-charts.mjs.
Boundary markers: The generated Markdown file contains data values in a standard table format without specific encapsulation or instructions to the agent to ignore content within the table.
Capability inventory: The skill can write files to the filesystem and execute an external binary.
Sanitization: Content is escaped for XML in SVG titles and pipe characters are escaped for Markdown tables, but no semantic sanitization is performed on the data content itself.

creating-charts