The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a sendPrompt bridge function that allows the rendered visual components to send messages back to the chat conversation, which the agent treats as user input. \n
Ingestion points: The visualizer processes data provided in the agent's context, which could include untrusted content from external files, websites, or user-provided strings. \n
Boundary markers: The visualizer code fence identifies the start and end of the visual content but there are no defined boundaries to separate untrusted data from the executable HTML/SVG/JavaScript logic within that fence. \n
Capability inventory: The bridge allows a visual to trigger new agent actions. A malicious payload embedded in visualized data (such as an onclick handler) could be used to send unauthorized instructions to the agent. \n
Sanitization: The skill instructions do not require the agent to sanitize or escape untrusted data before interpolating it into the HTML or SVG fragments, increasing the risk of script injection within the iframe or prompt injection via the bridge. \n- [EXTERNAL_DOWNLOADS]: The skill documentation describes fetching external JavaScript libraries from remote content delivery networks. \n
Trusted Sources: The references specify using cdnjs.cloudflare.com, esm.sh, cdn.jsdelivr.net, and unpkg.com for libraries like Chart.js and D3.js. These are well-known and trusted services. \n
Neutral Observation: The downloads are part of the intended functionality for rendering complex charts and diagrams and are intended to run within a sandboxed environment. \n- [METADATA_POISONING]: There is a discrepancy in the attribution of the skill in its metadata and documentation. \n
Evidence: The system identifies the author as ses2905, whereas the README and reference files attribute the skill to droid (factory.ai) and link to a repository owned by bentossell. This inconsistency could lead to confusion regarding the skill's origin and maintenance.

visualise