The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Node.js script (scripts/generate.js) to handle chart generation. This script is designed to accept either a raw JSON payload or a file path as its primary command-line argument.
[DATA_EXFILTRATION]: The scripts/generate.js script transmits chart data to an external service endpoint at antv-studio.alipay.com. This is the official API for the AntV visualization suite provided by Ant Group (Alipay), a well-known technology provider.
[PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection because it processes untrusted user-supplied data and has the capability to send that data to a remote server.
Ingestion points: Data for various chart types (26 options) is extracted from user inputs as described in SKILL.md and the references/ directory.
Boundary markers: None; the skill instructions do not specify any delimiters or safety warnings to ignore instructions that might be embedded within the user data.
Capability inventory: The skill can perform network operations via fetch to the AntV API and read local files via fs.readFileSync within the scripts/generate.js file.
Sanitization: None; the input data is parsed as JSON and passed directly to the external API without specific sanitization or validation against embedded natural language instructions.

chart-visualization