The Agent Skills Directory

[External Resource Loading]: The skill generates HTML stories that load the Plotly.js library from https://cdn.plot.ly/. Plotly is a well-known and established service for data visualization. This is a standard practice for including rich charting capabilities in portable HTML files while keeping file sizes manageable.
[Command Execution]: The workflow involves executing Python scripts, specifically a preprocessor for Excel files and a story builder script. In the identified sandbox environment, these scripts are run using standard Python invocations or the sandbox-exec wrapper, which is a platform-specific mechanism used to manage execution permissions.
[Script Generation and Validation]: The skill generates a report-building script (build_story.py) that assembles the final HTML output. A notable safety feature in this process is the use of node --check to perform a syntax check on the generated JavaScript before the file is finalized, which helps ensure the output is valid and free of unintentional syntax errors.
[Indirect Prompt Injection Surface]: Because the skill processes user-uploaded data (CSV, XLSX, JSON) to generate narrative text, it possesses an attack surface for indirect prompt injection. Maliciously crafted data could attempt to influence the agent's narrative generation. The skill mitigates this risk by grounding its storytelling in structured data analysis performed via SQLite and pandas, which separate the data processing from the narrative generation.

scrollytelling-data