The Agent Skills Directory

[NO_CODE]: The skill contains only Markdown reference files and does not include any executable scripts like Python, JavaScript, or Shell.
[EXTERNAL_DOWNLOADS]: Fetches core spreadsheet libraries and styles from Syncfusion's official CDN and NuGet registry, which are trusted sources.
[EXTERNAL_DOWNLOADS]: An automated scan flagged the URL https://your-api-endpoint.com/sales in references/data-binding.md as malicious; this is used as a generic placeholder in documentation.
[DATA_EXFILTRATION]: Provides code snippets for remote data binding and file saving that use placeholder external endpoints without providing warnings about the potential for sensitive data transmission to untrusted servers.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface in its generated code.
Ingestion points: User prompts for loading Excel files or fetching data from remote URLs (SKILL.md).
Boundary markers: None present in the generated CSHTML and C# code snippets to delimit untrusted content.
Capability inventory: Remote data fetching via DataManager and fetch, and file operations via Workbook.Open (references/import-export.md).
Sanitization: The provided code templates do not implement validation or sanitization for user-supplied URLs or file content.

syncfusion-aspnetcore-spreadsheet-editor