The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes organizational context and user-provided JSON files to generate strategic reports, creating a theoretical attack surface for indirect prompt injection.
Ingestion points: Input data is consumed from company_ai_state.json, ai_portfolio.json, ai_systems.json, and the local ~/.claude/company-context.md file.
Boundary markers: Absent; the instructions rely on the agent to parse organizational context without explicit delimiters or "ignore embedded instructions" warnings.
Capability inventory: The skill utilizes tool use to execute bundled Python scripts (ai_maturity_assessor.py, ai_investment_planner.py, ai_risk_register_generator.py) via the shell.
Sanitization: The Python scripts use standard JSON parsing and logical evaluations on specific data keys without executing the content as code, significantly mitigating the risk of instructions embedded in the data being obeyed by the underlying tools.
[EXTERNAL_DOWNLOADS]: The skill includes references to authoritative regulatory documentation.
Analysis: Provides links to the official European Union law portal (eur-lex.europa.eu) for the EU AI Act. This reference targets a well-known, trusted governmental service and is consistent with the skill's purpose as a governance advisor.
[COMMAND_EXECUTION]: The skill provides workflows that involve running local Python scripts.
Analysis: The instructions guide the agent to execute scripts such as python3 chief-ai-officer-advisor/scripts/ai_maturity_assessor.py. A security review of the provided Python source code confirms the scripts use only the standard library, perform no network operations, and do not utilize dangerous functions like eval() or exec().

chief-ai-officer-advisor