The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or data exfiltration attempts were detected. The skill's primary purpose is providing templates and utilities for compliance documentation. The Python scripts are well-structured and use only standard libraries for local data processing.
[INDIRECT_PROMPT_INJECTION]: The Python scripts (gap_analyzer.py and evidence_tracker.py) represent a surface for indirect prompt injection as they ingest untrusted data from local JSON files to generate reports. However, this behavior is essential to the skill's primary function and does not present a significant risk due to the scripts' limited capabilities.
Ingestion points: Data is ingested from files provided via the --controls and --matrix command-line arguments in scripts/gap_analyzer.py and scripts/evidence_tracker.py.
Boundary markers: The scripts do not implement specific delimiters or boundary markers to isolate user-controlled data within their printed text reports.
Capability inventory: Both scripts are limited to reading local files and printing results to standard output; they do not perform network requests, file writes, or command execution.
Sanitization: The scripts use standard JSON parsing without additional sanitization or filtering of the content before it is interpolated into the generated reports.

soc2-compliance