The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx skills add to download and install 8 specialized visualization skills from the antvis/chart-visualization-skills repository on GitHub. This is the intended installation mechanism for this package.
[DATA_EXFILTRATION]: The chart-visualization component transmits user-provided chart data to the third-party rendering service antv-studio.alipay.com. The documentation explicitly warns users not to use this specific skill for confidential data, as it is a cloud-based rendering service.
[COMMAND_EXECUTION]: Several components, including antv-g2-chart, antv-g6-graph, and icon-retrieval, use shell commands (curl) to interact with AntV's public HTTP APIs to retrieve icons or data-interpretation reports.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text content to generate infographics and narrative reports via the antv-infographic and antv-t8-ntv components. This creates an attack surface where instructions embedded in the processed data could potentially influence the agent's behavior. 1. Ingestion points: Processes user-provided text content in antv-infographic and antv-t8-ntv (SKILL.md). 2. Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are present in the skill definitions for isolating external content. 3. Capability inventory: The skill set performs network requests via curl and installs external code via npx (SKILL.md). 4. Sanitization: No explicit sanitization, escaping, or validation of the input text content is documented.

antvis-chart-skills