The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The library is designed to process external datasets which can contain untrusted content. The documentation describes features like custom tooltip formatting and SVG text spanning that use raw HTML or v-html rendering, creating a surface where malicious instructions or scripts embedded in the data could be executed or interpreted by the agent or the underlying application.
Ingestion points: The dataset prop used across all 69 components; the text parameter in the createWordCloudDatasetFromPlainText utility.
Boundary markers: The documentation does not specify the use of delimiters or warnings to prevent the agent from following instructions embedded within the dataset values.
Capability inventory: The library enables rendering of HTML strings and SVG elements based on data inputs, and provides methods like getImage (base64) and generateCsv which could be used in a chain to exfiltrate processed data.
Sanitization: The documentation for tooltip.customFormat and createTSpans indicates that the user (or agent) provides HTML strings directly, suggesting that the library may not perform internal sanitization on these specific formatting outputs.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the vue-data-ui package and its peer dependency jspdf via the standard NPM registry. These are legitimate public packages, and the download locations (NPM, GitHub) are well-known services.
[DYNAMIC_EXECUTION]: The library utilizes v-html for rendering specific SVG text components (createTSpans) and allows for dynamic HTML generation via tooltip callbacks. While this is a standard feature for visualization libraries, it represents a runtime execution of dynamically generated content based on the provided dataset.

vue-data-ui-skilld