The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides implementation patterns for interactive tooltips (in SKILL.md and assets/interactive-template.jsx) that use the D3 .html() method to render content. This creates an attack surface for Cross-Site Scripting (XSS) if the data processed by the skill is controlled by an external attacker.\n
Ingestion points: The data object passed to functions like drawVisualization and components like InteractiveChart across several files.\n
Boundary markers: Data values are interpolated directly into HTML strings without delimiters or instructions to ignore embedded code.\n
Capability inventory: The visualization logic uses d3.selection.html() to render tooltips to the DOM.\n
Sanitization: There is no evidence of sanitization, escaping, or validation of the input data before it is rendered as HTML in the provided examples.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions to load the D3 library from its official CDN service at https://d3js.org/d3.v7.min.js. This is a standard and recognized source for the library.

d3-viz