The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external business tools (CRM deals, P&L reports, calendar bookings) and user-supplied JSON brand configuration files. This data is interpolated into a generated HTML dashboard.
Ingestion points: configs/example.json, external business data files, and --brand JSON files containing design tokens.
Boundary markers: The skill instructions emphasize confirming all pre-filled data with the owner and documenting sources in the generated page.
Capability inventory: The skill uses scripts/build.py to write HTML files and performs a render check using headless Chrome via a shell command.
Sanitization: Data is serialized using json.dumps and escaped using a custom function in the HTML template. However, brand-related injections into CSS variables and font URLs provide secondary injection vectors.
[COMMAND_EXECUTION]: The skill uses shell commands to execute its internal build script (scripts/build.py) and a headless browser for rendering verification of the output page.
[DYNAMIC_EXECUTION]: The skill dynamically generates an interactive HTML dashboard by injecting configuration data into a static template. This generated content is subsequently executed during the render check phase.

growth-planner