The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes external data from the input/ directory, which presents a surface for indirect prompt injection if the datasets contain malicious instructions designed to influence the agent.
Ingestion points: Data files located in the input/<dataset>/ directory (referenced in SKILL.md).
Boundary markers: Absent; there are no explicit instructions to the agent to disregard instructions found within the data files.
Capability inventory: The skill utilizes Read, Write, Bash, Glob, and Grep tools to process data and generate outputs.
Sanitization: While the instructions mention cleaning data, they do not define specific security sanitization or validation logic to mitigate injection risks.
[EXTERNAL_DOWNLOADS]: The generated dashboard includes a reference to the Chart.js library hosted on the JSDelivr CDN (https://cdn.jsdelivr.net/npm/chart.js). This fetches the visualization library from a well-known service when the dashboard is opened in a browser.
[COMMAND_EXECUTION]: The skill workflow involves generating a Python script to perform data aggregation and dashboard rendering, which is then executed locally to produce the final HTML file.

dashboard