The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data to generate visualizations and perform file system writes. A malicious input could specify an arbitrary file path in the 'output' field, potentially leading to the overwriting of sensitive system or user configuration files.
Ingestion points: scripts/build_infographic.py reads JSON configuration from stdin or a file path.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are used during input parsing.
Capability inventory: The script uses open(output_path, 'w') and os.makedirs() to write files and create directories based on the output field in the JSON configuration in scripts/build_infographic.py.
Sanitization: The script uses html.escape to sanitize many text fields but fails to sanitize the color field in the breakdown data section, which can be controlled via the input JSON.
[DATA_EXFILTRATION]: The generated HTML output is vulnerable to Cross-Site Scripting (XSS) and CSS injection. The color property in the JSON breakdown data is directly interpolated into SVG attributes without escaping in the _svg_donut_chart function and with insufficient escaping in _svg_icon. An attacker could inject malicious scripts or CSS properties (such as background-image: url(...)) that trigger external network requests or execute code when a user views the generated file.

data-viz-gen