The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data that could serve as a vector for indirect prompt injection.
Ingestion points: Data is retrieved from the external Gateway API (gateway.can.aloudata.com) including metric names, dimension values, and time-series data.
Boundary markers: The instructions do not provide explicit delimiters or warnings to the agent regarding the handling of potentially untrusted data from the API.
Capability inventory: The agent is authorized to execute Python code, write image files to the local file system (plots), and make outbound network requests.
Sanitization: No explicit sanitization or validation logic is defined for the API responses before they are interpolated into diagnostic reports or processed by the internal Python logic.
[DYNAMIC_EXECUTION]: The skill includes embedded Python templates for complex calculations and data visualization.
The instructions provide specific code for performing Shapley value decomposition and generating waterfall charts using the matplotlib library.
These scripts are generated and executed locally at runtime to produce the final diagnostic output.
The logic also involves saving files (plots) to the local disk, which is a standard requirement for its analytical purpose.
[COMMAND_EXECUTION]: The skill utilizes curl to interact with the Gateway API. The construction of these commands involves environment variables ($CAN_API_KEY) and URL-encoded user input. While specific network domains are whitelisted, the execution of shell commands for data retrieval is a core component of the skill's workflow.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill requires the matplotlib Python package to be available for chart generation. It performs outbound network calls to gateway.can.aloudata.com to fetch configuration and data. These resources are associated with the vendor and the whitelisted domain.

metric-attribution