The Agent Skills Directory

[SAFE]: The skill metadata and documentation are consistent with its stated purpose. The orchestration patterns described (Configure, Map, Simulate, Consolidate) are standard in Integrated Management Systems (IMS).
[SAFE]: The Python scripts (framework_selector.py, cross_framework_mapper.py, audit_simulator.py, and evidence_pool_generator.py) use only Python standard libraries (argparse, json, sys, typing). They do not perform any risky operations such as file writing, network requests, or subprocess execution.
[SAFE]: The mock audit finding library (mock_audit_library.json) and framework mapping dictionaries are static, curated resources containing only descriptive text and regulatory citations.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it processes user-provided JSON profile and program files.
Ingestion points: The scripts accept external JSON files via command-line arguments to drive applicability and mapping logic.
Boundary markers: The scripts utilize standard JSON parsing to structure the input data.
Capability inventory: Analysis of all scripts confirms zero exploitable capabilities. The tool does not write to the file system, execute shell commands, or make network calls; it only outputs text reports to the console.
Sanitization: Content is parsed into structured objects, and natural language fields are treated as data for display in reports rather than as instructions.

compliance-os