The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external usage logs and activity data from Scenario MCP tools to generate Markdown, PDF, and HTML reports. This creates a potential surface for indirect prompt injection if an attacker could control metadata in the Scenario platform (e.g., model names or user identifiers) that the agent later reads in report form.\n
Ingestion points: scripts/analytics.py ingests JSON snapshots of Scenario usage data provided by MCP tools.\n
Boundary markers: SKILL.md includes instructions for the agent to independently validate scope, dates, and accounting metrics, and warns against carrying over unverified data markers.\n
Capability inventory: The skill writes to the local filesystem and executes a bundled Python script for data transformation.\n
Sanitization: scripts/analytics.py prevents CSV injection by escaping leading formula characters and uses JSON-safe character escaping for the HTML dashboard output.\n- [EXTERNAL_DOWNLOADS]: The skill mentions platform commands to install additional functionality from the same vendor's repository.\n
Evidence: SKILL.md provides instructions for using npx skills add scenario-labs/skills to install sibling skills.\n
Context: These references target the author's own repository and use the platform's standard package management tools.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute a bundled Python script for local processing and report generation.\n
Evidence: SKILL.md and references.md detail the use of scripts/analytics.py for rendering reports and calculating metrics.\n
Context: The execution is limited to the skill's own distributed code and operates strictly on local data snapshots without requiring network access or credentials.

scenario-admin-analytics