Case 03910
A fast, offline static risk analysis CLI for AI agent skill files. Detects malicious instructions, steganographic payloads, and dangerous capability chains.
npx -y skills add knownasnaffy/prompthound --skill case_03910Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Build deterministic, verifiable data visualizations with D3.js (v6). Generate standalone HTML/SVG (and optional PNG) from local data files without external network dependencies. Use when tasks require charts, plots, axes/scales, legends, tooltips, or data-driven SVG output.
SKILL.md
6.1 KB, ~1.5k tokens by cl100k_base, as published. Nobody here has run it
D3.js Visualization Skill
Use this skill to turn structured data (CSV/TSV/JSON) into clean, reproducible visualizations using D3.js. The goal is to produce stable outputs that can be verified by diffing files or hashing.
When to use
Activate this skill when the user asks for any of the following:
- “Make a chart/plot/graph/visualization”
- bar/line/scatter/area/histogram/box/violin/heatmap
- timelines, small multiples, faceting
- axis ticks, scales, legends, tooltips
- data-driven SVG output for a report or web page
- converting data to a static SVG or HTML visualization
If the user only needs a quick table or summary, don’t use D3—use a spreadsheet or plain markdown instead.
Inputs you should expect
- One or more local data files:
*.csv,*.tsv,*.json - A chart intent:
- chart type (or you infer the best type)
- x/y fields and aggregation rules
- sorting/filtering rules
- dimensions (width/height) and margins
- color rules (categorical / sequential)
- any labeling requirements (title, axis labels, units)
- Output constraints:
- “static only”, “no animation”, “must be deterministic”, “offline”, etc.
If details are missing, make reasonable defaults and document them in comments near the top of the output file.
Outputs you should produce
Prefer producing all of the following when feasible:
dist/chart.html— standalone HTML that renders the visualizationdist/chart.svg— exported SVG (stable and diff-friendly)- (Optional)
dist/chart.png— if the task explicitly needs a raster image
Always keep outputs in a predictable folder (default: dist/), unless the task specifies paths.
Determinism rules (non-negotiable)
To keep results stable across runs and machines:
Data determinism
- Sort input rows deterministically before binding to marks (e.g., by x then by category).
- Use stable grouping order (explicit
Array.from(grouped.keys()).sort()). - Avoid locale-dependent formatting unless fixed (use
d3.format,d3.timeFormatwith explicit formats).
Rendering determinism
- No randomness: do not use
Math.random()ord3-random. - No transitions/animations by default (transitions can introduce timing variance).
- Fixed
width,height,margin,viewBox. - Use explicit tick counts only when needed; otherwise rely on D3 defaults but keep domains fixed.
- Avoid layout algorithms with non-deterministic iteration unless you control seeds/iterations (e.g., force simulation). If a force layout is required:
- fix the tick count,
- fix initial positions deterministically (e.g., sorted nodes placed on a grid),
- run exactly N ticks and stop.
Offline + dependency determinism
- Do not load D3 from a CDN.
- Pin D3 to a specific version (default: [email protected]).
- Prefer vendoring a minified D3 bundle (e.g.,
vendor/d3.v7.9.0.min.js) or bundling with a lockfile.
File determinism
- Stable SVG output:
- Avoid auto-generated IDs that may change.
- If you must use IDs (clipPath, gradients), derive them from stable strings (e.g.,
"clip-plot").
- Use LF line endings.
- Keep numeric precision consistent (e.g., round to 2–4 decimals if needed).
Recommended project layout
If the task doesn't specify an existing structure, use:
dist/
chart.html # standalone HTML with inline or linked JS/CSS
chart.svg # exported SVG (optional but nice)
chart.png # rasterized (optional)
vendor/
d3.v7.9.0.min.js # pinned D3 library
Interactive features (tooltips, click handlers, hover effects)
When the task requires interactivity (e.g., tooltips on hover, click to highlight):
Tooltip pattern (recommended)
- Create a tooltip element in HTML:
<div id="tooltip" class="tooltip"></div>
- Style with CSS using
.visibleclass for show/hide:
.tooltip {
position: absolute;
padding: 10px;
background: rgba(0, 0, 0, 0.8);
color: white;
border-radius: 4px;
pointer-events: none; /* Prevent mouse interference */
opacity: 0;
transition: opacity 0.2s;
z-index: 1000;
}
.tooltip.visible {
opacity: 1; /* Show when .visible class is added */
}
- Add event handlers to SVG elements:
svg.selectAll('circle')
.on('mouseover', function(event, d) {
d3.select('#tooltip')
.classed('visible', true) // Add .visible class
.html(`<strong>${d.name}</strong><br/>${d.value}`)
.style('left', (event.pageX + 10) + 'px')
.style('top', (event.pageY - 10) + 'px');
})
.on('mouseout', function() {
d3.select('#tooltip').classed('visible', false); // Remove .visible class
});
Key points:
- Use
opacity: 0by default (notdisplay: none) for smooth transitions - Use
.classed('visible', true/false)to toggle visibility pointer-events: noneprevents tooltip from blocking mouse events- Position tooltip relative to mouse with
event.pageX/pageY
Click handlers for selection/highlighting
// Add 'selected' class on click
svg.selectAll('.bar')
.on('click', function(event, d) {
// Remove previous selection
d3.selectAll('.bar').classed('selected', false);
// Add to clicked element
d3.select(this).classed('selected', true);
});
CSS for highlighting:
.bar.selected {
stroke: #000;
stroke-width: 3px;
}
Conditional interactivity
Sometimes only certain elements should be interactive:
.on('mouseover', function(event, d) {
// Example: Don't show tooltip for certain categories
if (d.category === 'excluded') {
return; // Exit early, no tooltip
}
// Show tooltip for others
showTooltip(event, d);
})
Gives 0 of the 12 instructions most data analysis skills give in ~1.5k tokens
Counted across 286 of the 286 authors here whose files we hold, read 2026-08-06
- use excel formulas instead of hardcoded calculated valuesin 35 of 286, across 7 files
- match existing template conventions when modifying filesin 35 of 286, across 7 files
- document sources for all hardcoded valuesin 35 of 286, across 7 files
- write minimal concise python codein 35 of 286, across 7 files
- place all assumptions in separate assumption cellsin 32 of 286, across 5 files
- apply industry-standard color coding to financial modelsin 31 of 286, across 5 files
- format years as text stringsin 30 of 286, across 3 files
- recalculate formulas using recalc.py after modificationsin 30 of 286, across 3 files
- format negative numbers using parenthesesin 30 of 286, across 3 files
- fix all identified formula errors before finishingin 27 of 286, across 1 file
- use colorblind-safe palettesin 19 of 286, across 12 files
- Name tests after the prevented bugin 13 of 286, across 8 files
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.