The Agent Skills Directory

[SAFE]: The skill provides structured documentation and local analysis tools for SOC 2 compliance. No malicious patterns, obfuscation, or unauthorized access attempts were identified.
[COMMAND_EXECUTION]: The skill includes instructions to run Python scripts (scripts/soc2_readiness_score.py and scripts/evidence_gap_finder.py). These scripts use only Python's standard library for parsing YAML-like configuration files and generating reports. They do not execute arbitrary shell commands or use dangerous functions like os.system or subprocess.run with untrusted input.
[DATA_EXPOSURE]: The analysis scripts read local files provided via command-line arguments (--config and --evidence). While these files contain sensitive compliance data, the scripts process this information entirely locally and do not perform any network operations to exfiltrate the data.
[INDIRECT_PROMPT_INJECTION]: The scripts ingest data from external YAML files and interpolate it into Markdown or JSON reports. This creates a surface for indirect prompt injection if the output is subsequently processed by another agent. However, the risk is minimal as the scripts lack capabilities (like network access or system modification) that could be leveraged in an attack.

soc2-audit-prep