The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill ingests data from external sources, including verdict.json files and issue descriptions (description.md). This constitutes an indirect prompt injection surface as the agent processes content that may originate from outside its immediate environment.
Ingestion points: The skill reads campaign artifacts such as verdict.json, description.md, run.log, and original source files under the campaign directory.
Boundary markers: The skill documentation specifies that verdict.json files must be parsed and schema-validated against verdict-composition.md before aggregation.
Capability inventory: The skill is designed for read-only operations, rendering HTML, Markdown, or tables. It does not perform network writes, tracker modifications, or arbitrary command execution based on the ingested data.
Sanitization: The rendered HTML output is described as self-contained, intentionally excluding external CSS, JavaScript, and images to mitigate cross-site scripting (XSS) risks when viewed in a browser.
[Local Setup Validation]: The skill includes a pre-flight check that executes a local Python module using the command PYTHONPATH=.apache-magpie-local python3 -m setup_preflight. This pattern involves local command execution to verify the skill's configuration and integrity. This activity is consistent with the established setup procedures for the vendor's toolset and is used to ensure the environment is correctly prepared before proceeding with data analysis.

reassess-stats