The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches JavaScript libraries for data visualization from a well-known service (cdnjs.cloudflare.com). Evidence: The template assets/report-template.html and the instructions in SKILL.md reference https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.min.js and https://cdnjs.cloudflare.com/ajax/libs/d3/7.8.5/d3.min.js.- [PROMPT_INJECTION]: The skill's primary function involves processing external, potentially untrusted data (CSV, Excel, SQL results) and rendering it into a complex HTML format, which presents a surface for indirect prompt injection. * Ingestion points: Data provided by the user in CSV, Excel, or SQL result formats as described in the SKILL.md trigger conditions. * Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from obeying commands embedded within the input data. * Capability inventory: The skill generates complete HTML reports containing interactive JavaScript and CSS modules. * Sanitization: There are no explicit instructions for the agent to sanitize, escape, or validate the user-provided content before interpolating it into the assets/report-template.html file.

pm-analytics