The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones the grcskills library from https://github.com/better-isms/grcskills. This resource is owned by the skill's author and is used to load metadata for ranking purposes.
[COMMAND_EXECUTION]: The skill uses git clone to fetch the library index. It includes specific safeguards, such as cloning only specific tags and treating all fetched content strictly as data, not as instructions to follow.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it processes external data from compliance documents and skill files. It addresses this by instructing the agent to ignore any instructions embedded in the data. Capabilities are limited to reading specific document types and writing audit reports to a dedicated folder.
[DATA_EXFILTRATION]: An optional connection to an external MCP server (ismscopilot.com) is provided for framework lookups. The skill explicitly prohibits sending sensitive file content, personal data, or evidence to this external service, maintaining data privacy.

grc-setup-review