The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions explicitly require the agent to generate and execute a Python script to archive the generated HTML report. The workflow dictates that the agent must write content to a local file and then use the zipfile module to package it. Runtime generation and execution of code is a sensitive capability that can be misused if the generation logic is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided data, such as lamp design descriptions and part lists, to generate a multi-tabbed HTML report. Because this report content is subsequently written to the filesystem and handled by an execution script, it presents an attack surface for indirect injection.
Ingestion points: User-provided design descriptions, part lists, and design requirements provided during the interactive session.
Boundary markers: The skill does not define explicit boundary markers or delimiters to isolate user-provided data from the agent's instructions during report generation.
Capability inventory: The agent performs filesystem write operations (open(report_filename, 'w')) and executes Python code to process these files.
Sanitization: There are no instructions for sanitizing, escaping, or validating user-provided content before it is embedded into the HTML structure or processed by the zipping script.
[COMMAND_EXECUTION]: The requirement to package reports into ZIP files necessitates the execution of the Python interpreter and associated file system commands to manage the resulting archives.

auto-lamp-ip-advisor