The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The reporting asset assets/retention_matrix.html contains an XSS vulnerability due to unsafe data handling.
Ingestion points: The cohortData object, specifically its label and periods attributes, is used to store data for visualization.
Boundary markers: The template does not utilize any delimiters or protection mechanisms to isolate user-supplied data from executable code.
Capability inventory: The associated script uses the innerHTML property to dynamically build the table headers and cohort labels, which can execute arbitrary script content.
Sanitization: There is a complete lack of sanitization or character escaping for properties in the cohortData object, allowing an attacker to inject script tags through malicious user IDs or cohort labels in the source data.

cohort-analysis