The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the hsx command-line utility for workbook operations, including hsx eval which executes arbitrary JavaScript code strings to interact with the spreadsheet environment.
[EXTERNAL_DOWNLOADS]: The setup process involves downloading and installing the @hewliyang/headless-spreadjs package from the NPM registry. This package is managed by the skill's author.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it reads data from external Excel workbooks which could contain malicious instructions.
Ingestion points: Workbook data is read via hsx get, hsx csv, and hsx info commands.
Boundary markers: Absent. The instructions do not specify delimiters to separate data from commands.
Capability inventory: The agent can create/delete files, modify workbook structures, and execute JavaScript via the hsx toolset.
Sanitization: Absent. Content from spreadsheet cells is processed without validation for embedded instructions.

spreadjs