The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires a standard installation step using npm install to fetch the hyperformula and exceljs dependencies from the official npm registry. This is an expected operation for the skill's setup.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a processing engine for data and formulas provided by the agent, which may originate from external untrusted sources.
Ingestion points: Functions like addRow and addScenarioSheet in lib/sheet-model.mjs accept user-defined labels and formula strings.
Boundary markers: The skill does not implement delimiters or safety instructions to distinguish between data and potential instructions embedded within input strings.
Capability inventory: The skill can perform file system writes (via exportXlsx) and console output (via printScenarios).
Sanitization: Formula strings are resolved for internal references but are not otherwise sanitized for malicious spreadsheet functions (e.g., HYPERLINK exfiltration), which is a common risk in spreadsheet-generation tools.

sheet-model