The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill setup involves installing established third-party packages from official registries. These include surya-ocr for document text recognition, playwright for browser-based state inspection, and torch for powering the underlying OCR models. These are standard dependencies for the provided functionality.
[COMMAND_EXECUTION]: The skill operates primarily through CLI scripts (receipt_sorter.py and inspect-d365-expense.mjs) that perform file organization and report verification. These commands are intended to be executed locally by the agent to fulfill the user's expense management requests.
[INDIRECT_PROMPT_INJECTION]: By processing text extracted from external receipt files and Dynamics 365 web content, the skill interacts with untrusted data sources. However, the risk is minimized because the scripts do not directly interpolate this data into executable logic; instead, they use regular expressions to extract specific numerical or date fields and a slugify function to sanitize metadata before using it in file names.
[DYNAMIC_EXECUTION]: The Node.js inspector script utilizes Playwright's page.evaluate() to run data-extraction logic within the context of a Dynamics 365 browser session. While this constitutes dynamic execution, it is scoped to the target application domain and used solely for read-only verification of expense report details.

receipt-expense-workflow