The Agent Skills Directory

[SAFE]: The skill demonstrates safe behavior as a local data processing utility. Analysis of the scripts and documentation shows no evidence of prompt injection, credential exfiltration, or persistence mechanisms. The code relies solely on the Python standard library for its core functionality.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to process external trade data. Ingestion points: The skill ingests trade history from user-provided CSV files via the scripts/form_8949_generator.py script. Boundary markers: No specific delimiters or instructions to ignore embedded prompts are present in the script or instructions. Capability inventory: The skill's scripts are restricted to basic data parsing and arithmetic; there are no capabilities for network access, file system modifications, or shell command execution. Sanitization: The script performs standard type validation (e.g., Decimal and Date parsing) but does not specifically sanitize for indirect prompt injection strings, which is considered safe given the lack of exploitable downstream actions.

regulatory-reporting