The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a multi-phase pipeline that generates and executes Python code. Specifically, Phase 2 (Code Generation with Execution Loop) involves writing a self-contained script to a temporary file and running it via python figure_script.py. The instructions in references/figure-prompts.md explicitly authorize the LLM to 'use any python library you want,' which significantly expands the potential for unauthorized actions.
[COMMAND_EXECUTION]: The skill uses shell commands to execute both its internal template script and the dynamically generated visualization code. The pipeline relies on the python interpreter to run scripts created at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted user queries ($0) and external data files ($1) which are then interpolated into prompts used for code generation. A malicious data file or query could contain instructions designed to subvert the LLM's logic and generate harmful Python code.
Ingestion points: The skill ingests user descriptions and paths to data files (CSV, JSON, NPY, PKL) as seen in SKILL.md.
Boundary markers: Prompts in references/figure-prompts.md use triple quotes (""") to delimit user content, but there are no explicit warnings to ignore instructions embedded within the processed data.
Capability inventory: The agent has full Python execution capabilities and the ability to write/execute files on the local system.
Sanitization: There is no evidence of input validation, sanitization, or filtering applied to the user query or data file content before it is processed by the code generation agent.

figure-generation