The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including earnings transcripts and search results, and interpolates them into an HTML report. There are no instructions to sanitize or escape this data before insertion into the HTML template, which creates a potential surface for indirect prompt injection or cross-site scripting (XSS).
Ingestion points: Earnings transcripts (via get_transcript_from_key_dev_id) and Kensho search results (via search) stored in transcript-extracts.txt and kensho-findings.txt.
Boundary markers: No explicit delimiters or sanitization instructions are provided for the external content.
Capability inventory: The skill uses shell commands (mkdir, cat) and the open command to execute the generated HTML file in the user's browser.
Sanitization: No sanitization logic is described for the content interpolation.
[DYNAMIC_EXECUTION]: The skill generates a self-contained HTML file containing JavaScript (Chart.js) and custom data-driven logic, then instructs the agent to open this file in a browser. This script generation and execution pattern is used to render interactive financial charts within the report.
[COMMAND_EXECUTION]: The skill utilizes shell commands (mkdir -p, cat) to manage intermediate data files in the /tmp/earnings-preview/ directory and to load this data back into the agent's context for report generation. It also uses the open command to launch the final HTML report.
[EXTERNAL_DOWNLOADS]: The HTML template fetches the Chart.js library and the chartjs-plugin-annotation from the jsDelivr CDN. These references include specific version numbers and Subresource Integrity (SRI) hashes, which is a standard and safe practice for including third-party assets.

earnings-preview-single