The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest human responses from tabular datasets (CSV/XLSX) and generate reports. These responses are treated as data but the methodology emphasizes 'literal quotes' (citações literais) without applying sanitization or boundary markers. This creates a surface where malicious instructions hidden in survey data could influence the agent or downstream tools (like Claude Code) when the generated briefing is used as context (Category 8b
multi-step chains).
Ingestion points: Survey datasets (CSV, XLSX, JSON) uploaded by the user are processed in SKILL.md and scripts/analyze_survey.py.
Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore embedded commands within the survey text.
Capability inventory: The agent writes Markdown briefings (briefing.md), standalone HTML dashboards (dashboard.html), and generates Python analysis scripts.
Sanitization: Absent. The skill documentation explicitly instructs to preserve the original vocabulary and content of user responses to maintain 'authenticity'.
[EXTERNAL_DOWNLOADS]: The HTML dashboard templates (assets/dashboard-template.html and examples/aiox-fundamentals-dashboard.html) fetch external resources including Chart.js and Google Fonts.
Evidence: https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.js, https://fonts.googleapis.com, and https://fonts.gstatic.com.
Assessment: These are well-known, trusted services (Cloudflare and Google) used for legitimate visualization and styling purposes.
[DYNAMIC_EXECUTION]: The skill provides a template script scripts/analyze_survey.py and instructions to generate custom Python scripts for data analysis.
Evidence: The SKILL.md workflow includes generating a {nome}_analysis.py file.
Assessment: The execution is performed by the user/agent using standard libraries (e.g., pandas) and is considered a low-risk development workflow utility.

survey-intel