The Agent Skills Directory

Command Execution: The skill executes external tools like d2 for diagram layout and fc-match for font discovery using spawnSync. The script includes specialized logic to escape user-provided strings (such as node labels) before passing them to these utilities, which is an important measure for managing the security of external process calls.
Input Validation: The dataset-contract module performs detailed validation of input data. It specifically checks for reserved JavaScript keys like __proto__ to prevent potential prototype pollution and enforces a strict schema for all data fields and rows.
Path Confinement: The script utilizes a confinement function that validates output file paths against the working directory. This ensures that the skill only writes files within the intended project workspace, preventing potential path traversal considerations.
Indirect Prompt Injection Surface: The skill processes external JSON specifications which can contain user-supplied labels and values. While this represents an ingestion surface for external data, the skill manages associated risks by using a declarative transformation pipeline and strictly escaping content before it is used in visual rendering or command arguments.

data-viz