The Agent Skills Directory

[SAFE]: The skill is a legitimate academic utility authored by AlterLab. It focuses on drafting documentation according to funder-specific guidelines and uses local resources only.
[COMMAND_EXECUTION]: The skill includes a Python script, scripts/report_deadlines.py, which is called to compute report due dates. Technical inspection of the code confirms it is safe: it uses only the Python standard library (argparse, json, sys, dataclasses, datetime), performs no network operations, and contains no system-level commands or shell execution vulnerabilities.
[EXTERNAL_DOWNLOADS]: No external packages or remote scripts are downloaded or executed. All logic is contained within the provided files.
[DATA_EXFILTRATION]: No exfiltration patterns were found. The skill does not access sensitive local files (e.g., SSH keys, credentials) and does not perform network requests.
[PROMPT_INJECTION]: The skill was evaluated for indirect prompt injection surfaces. \n
Ingestion points: Processes user-supplied progress notes, publication lists, and project metadata (referenced in SKILL.md and evals.json). \n
Boundary markers: Lacks explicit boundary markers for untrusted data, though it uses [TODO] placeholders to ensure user verification of drafted content. \n
Capability inventory: Limited to executing the local report_deadlines.py script and generating text drafts. \n
Sanitization: No explicit sanitization of input data is performed. \n
Assessment: This surface is inherent to the skill's primary function of drafting reports and does not pose a significant risk given the restricted capabilities.

alterlab-grant-reporting