The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes third-party vendor data from JSON catalogs and SLA records. This creates a potential surface for indirect prompt injection where malicious data in JSON fields could attempt to influence the agent's synthesized recommendations.
Ingestion points: Data enters the agent's context through scripts/vendor_scorer.py, scripts/sla_compliance_tracker.py, and scripts/vendor_risk_classifier.py via the --input argument.
Boundary markers: The skill utilizes structured JSON parsing which provides a clear data boundary, though it lacks explicit prompt-level delimiters to warn against embedded instructions in the vendor data.
Capability inventory: The skill is limited to local file reading, writing to specified output paths, and deterministic performance/risk calculations. No network access or shell execution capabilities are present in the provided scripts.
Sanitization: Input is validated using standard Python JSON parsing, ensuring structural integrity.
[EXTERNAL_DOWNLOADS]: The reference files contain links to numerous external industry frameworks, security standards, and case studies. All referenced URLs point to trusted organizations and well-known services, such as NIST, CISA, Gartner, Google, AWS, and Microsoft. These links are for informational purposes only and do not trigger runtime downloads or code execution.
[SAFE]: The Python scripts are well-structured, use only standard libraries (argparse, json, dataclasses, enum, pathlib), and contain no hidden logic, obfuscation, or dynamic execution patterns. The skill's stated purpose aligns perfectly with its implementation.

vendor-management