The Agent Skills Directory

[SAFE]: The skill incorporates security measures to prevent identity spoofing. It includes logic to detect and refuse names containing hidden characters or homoglyphs that mimic the 'agent:' prefix, ensuring only human-authorized registrations are valid.\n- [DATA_EXFILTRATION]: The tool prevents data leakage by managing business metrics within a local, git-ignored directory (".skill-contract/growth/") and providing explicit instructions to the agent not to send sensitive data to external models.\n- [OBFUSCATION]: Static detector hits for unicode steganography in "assets/test_growth_plan.py" were identified as test cases. These are used to verify the tool's own security feature that rejects hidden characters like Right-to-Left Override (U+202E).\n- [DYNAMIC_EXECUTION]: The dynamic import flagged in "assets/test_growth_hardening.py" is used for standard file system cleanup during unit testing and does not affect the security of the main application logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metrics data but effectively mitigates injection risks through strict numerical parsing and a sanitization function that escapes non-printable characters before display.

growth-review