The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a structural linter (scripts/validate_report.py) designed to verify the integrity of generated reports. Analysis confirms the script is written using only the Python standard library and contains no logic for network access, file system modification beyond reading the target report, or subprocess execution.
[EXTERNAL_DOWNLOADS]: Security scans flagged the domain pavco.com.co as potentially malicious. However, this is the official domain of a major, legitimate Colombian industrial manufacturer (Pavco Wavin), which is explicitly listed as a relevant Tier 2 supplier for construction materials research in the skill's reference data.
[PROMPT_INJECTION]: As a tool designed to aggregate and synthesize information from external sources, the skill has an inherent exposure to indirect prompt injection.
Ingestion points: Data enters the context via WebSearch and WebFetch tool outputs used during the sourcing stage.
Boundary markers: The instructions do not explicitly mandate the use of XML tags or other delimiters to isolate untrusted web content.
Capability inventory: The agent can perform web operations and execute the included Python validation script.
Sanitization: Content fetched from the web is processed according to 'grounding rules' aimed at accuracy, but there is no specific instruction for escaping or sanitizing potential adversarial instructions within the data.
[SAFE]: Automated detection of suspicious HTTP patterns in references/report-template.md is identified as a false positive caused by the presence of standard markdown placeholders and example URLs used in the documentation.

procurer