The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md contain directives that override the agent's standard safety and interaction model. Specifically, it commands the agent to 'Run all steps without asking for confirmation' and 'Do NOT ask Ready to proceed? or Should I open the dashboard?', which suppresses user oversight for file writes and browser execution.
[COMMAND_EXECUTION]: The script assemble_dashboard.sh uses an unsafe pattern for generating Python code by directly interpolating shell variables into a Python heredoc. The use of '''$SCREEN_SUMMARY''' and similar placeholders allows the contents of local data files to potentially escape string literals and execute arbitrary Python logic if they contain triple-quote sequences.
[COMMAND_EXECUTION]: The skill automatically executes platform-specific commands (open, xdg-open, explorer.exe) to launch a generated HTML dashboard in the user's browser. Because the dashboard incorporates data from JSON files without sanitization, this creates a vector for local Cross-Site Scripting (XSS) if the performance data is maliciously crafted.
[EXTERNAL_DOWNLOADS]: The dashboard-template.html file fetches necessary frontend libraries and assets from well-known services, specifically Chart.js via the jsDelivr CDN and fonts from Google Fonts.

perf-dashboard