The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/validate_due_diligence.py) to validate the integrity of input data and the generated report. This script uses only the Python standard library for regex and JSON processing and does not involve network operations or dynamic code evaluation.
[DATA_EXFILTRATION]: The skill requires access to sensitive enterprise and personal data, including the PBOC Credit Reference System. However, it implements strict data protection controls, including mandatory manual authorization for credit checks and comprehensive desensitization rules (e.g., masking ID numbers and bank accounts). These operations are core to the skill's primary purpose and follow established financial security best practices.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes untrusted user-uploaded documents such as contracts, invoices, and bank statements.
Ingestion points: Data enters the context via user_upload (financial reports, contracts, invoices) and system_api (ECIF, PBOC reports) across Steps 0, 6, 7, and 8.
Boundary markers: The skill employs a 'step-gated' workflow where Step 0 performs mandatory data confirmation and validation before any analysis begins. Step 6 uses multi-dimensional cross-verification (e.g., comparing electricity usage vs. revenue) as a logical integrity check.
Capability inventory: The skill has the ability to run local scripts for validation, perform authorized network API calls to vendor systems (Aliyun), and write audit logs to the file system.
Sanitization: The skill includes explicit rules for desensitizing sensitive personal data but relies on its structured workflow and cross-verification logic to handle the semantic integrity of document contents.

credit-due-diligence