The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run with shell=True and string interpolation in its connection examples (e.g., examples/wrds_connector.py). While this is part of the core functionality for establishing SSH tunnels to WRDS, the implementation pattern is susceptible to command injection if used with untrusted inputs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from SEC filings, creating an indirect prompt injection surface.
Ingestion points: Raw filing content is read in processFile and related functions across multiple Go-based parsers.
Boundary markers: Filings are parsed using specialized Go programs rather than direct LLM interpolation. The resulting data is structured in TSV format.
Capability inventory: The skill performs shell command execution (qsub, sas, rclone) and remote SSH operations.
Sanitization: The Go source code (e.g., scripts/parse_npx/main.go) includes a sanitize function that replaces tabs and newlines in extracted text to prevent record injection in the TSV output.
[DYNAMIC_CONTEXT_INJECTION]: SKILL.md uses the !command syntax to generate a table of contents.
Evidence: !d=${CLAUDE_SKILL_DIR}; command -v skill-toc ...
Assessment: This is a benign use of the dynamic context feature for local utility execution (skill-toc). It does not exfiltrate data or accept user-provided arguments.
[SAFE]: The automated scanner detection of musicmaker.com is a false positive. The domain appears solely as a string literal in regular expression examples and documentation (e.g., in scripts/parse_s1_mgmt/README.md) reflecting historical SEC filing contents, and is not the target of any network activity.
[SAFE]: The skill author includes security-focused regression tests (e.g., TestPathContainment in scripts/parse_npx/containment_test.go) that verify the parser cannot read files outside the designated archive root, demonstrating an 'assume-malicious' posture for file system operations.

wrds