The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_market_visuals.py dynamically assembles and executes shell commands to automate visual generation.
Evidence: The script uses subprocess.run to invoke other Python scripts (scientific-schematics and generate-image) found at computed relative paths.
Risk: While the script correctly uses a list for command arguments (minimizing traditional shell injection), the practice of executing external scripts based on computed paths and user-provided inputs increases the attack surface for the environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via user-supplied market topics.
Ingestion points: User input is accepted through the --topic argument in scripts/generate_market_visuals.py.
Boundary markers: No boundary markers or "ignore previous instruction" delimiters are used when interpolating the topic into downstream prompts.
Capability inventory: The skill uses the subprocess.run capability to pass these interpolated prompts to image and schematic generation tools.
Sanitization: There is no evidence of input validation or sanitization to prevent a malicious user from providing a topic string designed to hijack the behavior of the visual generation tools.

market-research-analysis