The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external Environmental Product Declaration (EPD) documents and CSV files retrieved from the web. This creates a surface for indirect prompt injection where malicious instructions embedded in these external documents could attempt to influence the agent's behavior.
Ingestion points: The skill uses WebFetch and WebSearch to retrieve original source documents (PDFs/HTML) and reads local files like epd-library.csv.
Boundary markers: The instructions mandate reporting retrieved facts, derived calculations, and interpretation separately, and require visual inspection of original bytes.
Capability inventory: The agent has access to Bash, Write, WebFetch, and WebSearch tools.
Sanitization: The skill requires validating hash and schema for CSV files but does not specify sanitization for natural language content parsed from PDFs or websites.
[COMMAND_EXECUTION]: The skill configuration allows the use of the Bash tool and references process.run for native validation operations.
Evidence: The allowed-tools list in SKILL.md includes Bash, and host-contract.json specifies process.run as an optional operation in several modes (e.g., file-output, record-read). These are intended for native validation via the product_library.validate operation but represent a capability that requires careful handling of external data.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch environmental data from external web sources.
Evidence: The skill uses WebFetch and WebSearch to retrieve "applicable original or authorized supplied documents" for EPD research and comparison.

epd-compare