The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill focuses on generating Python and R scripts by incorporating user-provided data and metadata (such as axis labels, titles, and dataset values) into predefined code templates. This behavior introduces a surface for indirect prompt injection, where maliciously crafted user input could attempt to break out of string literals to execute arbitrary code within the plotting environment.
Ingestion points: User-supplied data and styling requirements are processed in SKILL.md and references/element-plots.md to generate executable code.
Boundary markers: No specific delimiters or "ignore instructions" warnings are included in the code templates to mitigate injection via data values.
Capability inventory: The skill utilizes uv, uvx, and Rscript to execute generated code and performs file system writes to save SVG/PNG outputs.
Sanitization: The provided instructions do not include explicit steps for the agent to sanitize or escape user-provided strings before interpolation.
[COMMAND_EXECUTION]: The skill suggests commands for quality assurance that utilize environment variables, such as $FIGURE_QA_SCRIPTS. While standard for developer workflows, this pattern can be sensitive if the environment is not properly isolated.
Evidence: The Quality assurance section in SKILL.md includes the command: uv run python "$FIGURE_QA_SCRIPTS/check_plot_script.py" panel.py --journal nature.
[EXTERNAL_DOWNLOADS]: The skill encourages the use of uv and uvx to fetch packages from the Python Package Index (PyPI) and provides references to the scienceplots library hosted on GitHub. These are well-known services and the downloads are documented for their intended scientific purpose.
Evidence: Instructions to use uv run --with scienceplots and references to https://github.com/garrettj403/SciencePlots appear in SKILL.md and references/sciplots-recipes.md.
[DYNAMIC_EXECUTION]: The skill facilitates the runtime generation and execution of Python and R scripts based on templates. This is categorized as low risk as it follows standard patterns for automated plot generation from known templates.
Evidence: The use of uvx --from "..." python -c "..." and Rscript -e '...' in references/element-plots.md to generate and run transient code blocks.

plot-styling