The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates executable JavaScript files by interpolating data into placeholders within templates.
Evidence: In SKILL.md, the workflow involves copying assets/template/script.js and replacing {{VENN_DATA}}, {{COLOR_SCHEME}}, and {{DEFINITIONS}} with computed values.
Risk: If the input data (from the user or the project glossary) contains malicious JavaScript, it will be embedded directly into the generated script.js and executed in the browser context of the viewer.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project files to influence its output, creating an attack surface for indirect instructions.
Ingestion points: The skill is instructed to read /docs/glossary.md to extract definitions for the diagram tooltips.
Capability inventory: The agent has the capability to write multiple files (HTML, JS, CSS, JSON, Markdown) to the filesystem under /docs/sims/.
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the glossary content being processed.
Sanitization: There are no explicit instructions to validate or escape the content retrieved from the glossary before it is used in the template interpolation.
[EXTERNAL_DOWNLOADS]: The generated visualization files depend on external JavaScript libraries hosted on a content delivery network.
Evidence: assets/template/main.html includes scripts from https://cdnjs.cloudflare.com/ajax/libs/d3/7.9.0/d3.min.js and https://cdnjs.cloudflare.com/ajax/libs/venn.js/0.2.20/venn.min.js.
Note: These references target a well-known service and specific versions of established open-source libraries.

venn-diagram-generator