The Agent Skills Directory

[Prompt Injection Defenses]: The skill instructions proactively address potential prompt injection by mandating that any imperative text within user-uploaded files be treated strictly as data rather than instructions. This defensive posture helps prevent 'jailbreak' attempts that might be hidden in business documents.
[Data Sanitization]: During the report generation phase, the skill requires that every user-provided value be HTML-escaped. This is a critical security measure that prevents potential Cross-Site Scripting (XSS) vulnerabilities in the generated HTML reports.
[Privacy and Safety Guardrails]: The skill includes specific rules to protect internal reasoning and factor codes from being exposed to the user. While these instructions include 'concealment' patterns, they are used here as a legitimate privacy control rather than a malicious obfuscation technique.
[Indirect Prompt Injection Surface]: Because the skill ingests a wide variety of untrusted file formats (PDF, DOCX, XLSX) to extract use-case details, it naturally possesses an indirect prompt injection surface. However, the presence of explicit boundary instructions and sanitization protocols effectively mitigates this risk.
[Authorized Tooling]: The skill utilizes platform-specific capabilities for chart generation (matplotlib) and secure file I/O (SharePoint/OneDrive via Graph). These operations are aligned with the skill's primary purpose and use established, vendor-supported interfaces.

ai-usecase-assessment