The Agent Skills Directory

[SAFE]: The skill uses a local Python script (scripts/report.py) to process data, avoiding remote API dependencies for the core report generation. It uses reputable libraries like pandas and matplotlib for analysis and visualization.
[SAFE]: The report generation script correctly implements output sanitization using html.escape() for all data fields (KPIs, table cells, titles) before embedding them in the final HTML file, effectively preventing XSS vulnerabilities in the generated reports.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which presents a surface for indirect prompt injection. However, this is mitigated by the architecture and instructions.
Ingestion points: User-provided .csv, .json, and .xlsx files are processed by the analyze and report commands in scripts/report.py.
Boundary markers: The agent is instructed to use a structured JSON summary produced by a script rather than the raw data, and explicit instructions ("不要捏造数字，只做解读") restrict the agent's behavior to interpretation only.
Capability inventory: The skill has local file system access for reading data and writing HTML/PNG outputs via report.py and render_card.py.
Sanitization: While the HTML output is escaped to prevent code execution, there is no pre-processing filter to strip natural language instructions that might be embedded in the input data values.

data-report