The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from pandas DataFrames and uses it to generate HTML reports. Specifically, the generate_html_report function in scripts/quality_metrics.py interpolates scorecard.dataset_name, m.dimension.value, and m.name directly into an HTML string without sanitization.
Ingestion points: scripts/quality_metrics.py via generate_scorecard and generate_html_report functions receiving user-controlled DataFrames and metadata strings.
Boundary markers: Absent. The report generation does not use delimiters or instructions to ignore embedded content.
Capability inventory: The skill uses pandas, scipy, and numpy for analysis. It does not perform network operations or dangerous system calls directly, but the generated HTML could be rendered in a context where embedded scripts or instructions might influence the agent.
Sanitization: Absent. Values are interpolated directly into the f-string in generate_html_report.

data-quality