The Agent Skills Directory

[SAFE]: The skill provides construction-specific data processing logic using standard libraries (pandas, numpy) to manage cost databases and update resource rates. All operations are local and consistent with the described business case.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data from files (Excel, CSV, Parquet) which could contain untrusted content.
Ingestion points: The import_external_rates method in SKILL.md processes data from external DataFrames.
Boundary markers: The instructions.md file explicitly directs the agent to "Validate inputs before processing" and "Only use data provided by the user."
Capability inventory: The skill has file-writing capabilities (export_change_log and export_updated_data in SKILL.md) but lacks network access or arbitrary command execution.
Sanitization: The Python implementation performs basic type conversion (e.g., casting rates to floats) which limits the impact of non-numeric malicious data.
[DATA_EXPOSURE_EXFILTRATION]: The skill requests filesystem permissions to facilitate the import and export of construction data. There is no evidence of access to sensitive system paths (e.g., SSH keys, credentials) or network exfiltration patterns.
[COMMAND_EXECUTION]: The skill metadata requires the python3 binary to run the data processing logic. The code provided is focused strictly on data manipulation within the Python environment.

cwicr-rate-updater