The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The requirements.txt file includes a package named main. This is a non-standard and highly suspicious package name for a Python project. It contrasts with the instructions in references/requirements.txt which claim that no external dependencies are required and only the standard library is used.
[METADATA_POISONING]: The SKILL.md file explicitly claims that input file paths are validated against directory traversal (no ../), yet the actual implementation in scripts/main.py utilizes the provided paths directly with open() and os.makedirs() without any validation or sanitization.
[COMMAND_EXECUTION]: The script scripts/main.py accepts arbitrary file paths for the --output parameter via the command line. Because the script lacks path validation, it allows the creation or overwriting of files in any directory the execution environment has permissions to access.
[INDIRECT_PROMPT_INJECTION]: The skill processes clinical justification text from an external JSON file and interpolates it directly into the generated document, creating a potential vector for instructions to be embedded in data.
Ingestion points: The clinical_justification field within the JSON file provided to the --input argument in scripts/main.py.
Boundary markers: Absent. The justification text is joined and appended to the letter body without delimiters.
Capability inventory: The script performs file writes (open) and directory creation (os.makedirs).
Sanitization: Absent. The script performs basic formatting (stripping and splitting by newline) but does not validate or escape the content of the clinical justification.

prior-auth-letter-drafter