The Agent Skills Directory

[SAFE]: The skill facilitates interaction with the official Datawrapper API at api.datawrapper.de, which is a well-known and reputable service for data visualization.
[SAFE]: Security best practices are followed for credential management; the skill uses the DATAWRAPPER_API environment variable and includes explicit instructions to the agent never to print or disclose the value to prevent accidental leakage.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied CSV data to generate visualizations, which is a standard surface for indirect prompt injection.
Ingestion points: Local CSV files are read and uploaded using curl --data-binary @/path/to/data.csv in SKILL.md, references/chart.md, and references/choropleth-map.md.
Boundary markers: No specific delimiters or safety warnings are implemented for the content of the data files.
Capability inventory: The skill uses curl to send data to the network and jq to process JSON responses.
Sanitization: There is no evidence of sanitization or validation of the CSV content before it is transmitted to the external API, although this is the intended primary function of the skill.

datawrapper