The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various file formats (CSV, TSV, JSON, XLSX) to generate visualization reports. While this presents an indirect injection surface, the implementation follows security best practices by using HTML escaping for user-controlled strings (titles, captions, and labels) and correctly encoding embedded JSON data to prevent Cross-Site Scripting (XSS).
Ingestion points: Reads data from files specified in the request JSON via visualization_io.py.
Boundary markers: Not explicitly used in the data ingestion, but the prompt instructions emphasize sticking to the provided statistical guides.
Capability inventory: File read operations, local HTML generation, and CLI-based execution.
Sanitization: Uses html.escape in visualization_html.py and JSON character escaping for script tags.
[EXTERNAL_DOWNLOADS]: The generated HTML templates reference external JavaScript libraries (vchart and vchart-statplots) hosted on unpkg.com. These are official vendor resources developed by the skill's author and are necessary for the visualization functionality.
[COMMAND_EXECUTION]: The internal test suite (tests/test_visualization_cli.py) uses subprocess.run to execute and verify the skill's own Python scripts. This is a standard developer testing pattern and does not facilitate arbitrary command execution during production use.

data-science-visualization