The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/officecli_render.py utilizes subprocess.run to execute an external binary named officecli. While the implementation uses shell=False and handles arguments as a list, it introduces a dependency on a third-party executable that must be present on the system's PATH.
[DYNAMIC_EXECUTION]: The engine in scripts/viz.py performs dynamic loading of helper modules (dataclean and ingest) via importlib.import_module. These modules are loaded from paths computed at runtime relative to the skill's location.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data for visual report generation. 1. Ingestion points: Data enters through the rows_from_xlsx function in scripts/viz.py and via analysis results processed in both scripts/viz.py and scripts/workbook.py. 2. Boundary markers: No explicit boundary markers or ignore-embedded-instruction warnings are present in the processing logic. 3. Capability inventory: The skill has the capability to write HTML and Excel files to the local file system (see scripts/viz.py and scripts/workbook.py) and execute shell commands via the OfficeCLI adapter. 4. Sanitization: Visible data labels and values are sanitized using an internal HTML escaping helper function (_e), but the skill remains susceptible to indirect injection if the source data is maliciously crafted.

data-visualise