The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external financial websites, creating a surface for potential indirect prompt injection attacks.
Ingestion points: The skill retrieves data from finance.yahoo.com using Chrome snapshots and DOM extraction in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are used to separate scraped web content from the agent's instructions.
Capability inventory: The skill has access to Bash, Write, and browser-based script execution tools.
Sanitization: The instructions do not specify sanitization or validation logic for the data extracted from the web before it is used for chart generation or text observations.
[DYNAMIC_EXECUTION]: The skill generates and executes code at runtime to achieve its visualization goals.
Script generation: It dynamically assembles a self-contained HTML file containing financial data and JavaScript libraries.
Browser evaluation: It uses the mcp__chrome-devtools__evaluate_script tool to run JavaScript snippets in the browser to parse financial tables.
[EXTERNAL_DOWNLOADS]: The skill references external code and data sources.
CDN references: The generated HTML file loads Chart.js and the datalabels plugin from cdn.jsdelivr.net, a well-known and established content delivery network.
Data sources: The skill fetches financial statements and stock metrics via Yahoo Finance MCP tools and web scraping.

cashflow-chart