The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes robust defenses against prompt injection. The 'Untrusted Content Boundary' section in SKILL.md and references/safety.md explicitly instructs the agent to treat subject data as evidence rather than instructions, and to ignore any embedded requests to reveal secrets or expand permissions.
[DATA_EXFILTRATION]: No hardcoded credentials or data exfiltration patterns were found. The skill includes automated tests in tests/test_contracts.py that specifically scan for hardcoded secrets and tokens, demonstrating a proactive security posture.
[REMOTE_CODE_EXECUTION]: The validation scripts (scripts/validate_bundle.py) and tests (tests/test_contracts.py) rely exclusively on the Python standard library. The skill does not perform external downloads or execute remote code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from repositories, but it implements strong safety controls.
Ingestion points: Files, archives, and metadata from audited repositories.
Boundary markers: Explicitly defined in the 'Untrusted Content Boundary' sections of SKILL.md and references/safety.md.
Capability inventory: The skill is diagnostic and read-only; it lacks tools to perform mutations or network calls on the audited subjects.
Sanitization: Instructions mandate factual extraction and minimal quoting to prevent instructions in subject data from influencing the agent's behavior.
[COMMAND_EXECUTION]: The skill uses standard shell commands (mkdir, cp) in its documentation for installation, but its internal scripts are confined to safe filesystem operations for validation and testing purposes.

oss-tool-trust-audit