The Agent Skills Directory

[SAFE]: The skill is designed for engineering analysis and demonstrates a high level of security awareness in its implementation.
[COMMAND_EXECUTION]: The skill utilizes local Python scripts (calculate_fta.py, generate_diagram.py, generate_report.py, score_analysis.py) to perform its functions. These scripts use standard libraries and do not spawn untrusted subprocesses or execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided failure data and event descriptions. It mitigates potential injection and XSS risks by explicitly instructing the agent to treat input as data and by using the html.escape() function in generate_report.py to sanitize content before it is interpolated into HTML reports.
[DATA_EXFILTRATION]: No network operations or exfiltration vectors were found. The scripts do not use networking libraries and operate strictly on local files.
[PRIVILEGE_ESCALATION]: The skill does not attempt to gain elevated privileges. It includes a _validate_path helper in all scripts to prevent path traversal attacks by rejecting paths containing .. and restricting file extensions to expected types (.json, .html, .svg).
[DYNAMIC_EXECUTION]: The skill avoids dangerous dynamic execution patterns. It does not use eval(), exec(), or unsafe deserialization methods like pickle.

fault-tree-analysis