The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided data (construction financial tables) to perform audit calculations.
Ingestion points: scripts/run.mjs reads user data from files specified by the --input argument or via raw text input.
Boundary markers: None are present in the processing logic to delimit the untrusted content from the system context.
Capability inventory: The skill uses fs.readFileSync to read local files and prints results to the console via console.log. It does not perform network operations or file writes.
Sanitization: The engine uses numeric normalization and regex-based header matching, but does not explicitly sanitize the raw text before it is returned in the finding descriptions.
[EXTERNAL_DOWNLOADS]: The SKILL.md file contains instructions for the AI agent to facilitate a purchase of the full version using the @alipay/agent-payment package via npx.
Finding: The skill references an external installation command for the Alipay payment agent.
Evidence: npx -y @alipay/agent-payment@latest install is provided in a prompt template within SKILL.md.
Context: The download targets a well-known financial service provider (Alipay) and is intended for a legitimate upselling flow to the paid version of the tool.
[COMMAND_EXECUTION]: The skill is intended to be executed as a command-line tool.
Evidence: node scripts/run.mjs is the primary entry point described in SKILL.md and implemented in the scripts/ directory.
Context: The script executes local JavaScript logic using Node.js built-in modules (fs, path, url) to perform mathematical audits on data provided by the user.

construction-monthly-selfcheck-free