The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill interacts with https://quickchart.io/chart to render chart images. QuickChart is a well-known service for programmatic chart generation. The skill also downloads the resulting PNG file to the local system.
[COMMAND_EXECUTION]: The skill utilizes the curl tool via Bash to communicate with the external API. It explicitly mandates a security pattern to prevent command injection: writing the JSON payload to a file using the Write tool and then using the @filename syntax with curl to avoid shell interpolation of untrusted user data (labels, titles, values).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it ingests and processes untrusted data from user prompts and local CSV files.
Ingestion points: Data is read from user-supplied strings and local file paths provided by the user (e.g., /path/to/data.csv).
Boundary markers: The instructions include explicit warnings for the agent to treat CSV contents as untrusted data and not as instructions, though it lacks formal delimiters for the data during processing.
Capability inventory: The skill has Bash(curl *) capabilities for network operations and Read/Write permissions for file system interaction.
Sanitization: The skill implements a robust sanitization strategy for command execution by staging payloads in JSON files to prevent character-based shell injection attacks.

chart