The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted security findings which might contain malicious payloads. It implements a protective mechanism in render_report.py via the _fence function, which dynamically calculates the required markdown code fence depth (e.g., using four backticks if the content contains three) to ensure that untrusted evidence text cannot break the report structure.
[COMMAND_EXECUTION]: Static analysis identified subprocess.run in tests/test_render_report.py. This is a standard testing implementation used to execute the skill's own reporting script for validation purposes, restricted to the local Python interpreter and known test paths.
[DATA_EXFILTRATION]: No network tools, HTTP clients, or data transmission patterns were found. The skill operates exclusively on local file reads and writes within a user-defined output directory, with explicit instructions to the agent to avoid including secrets in the generated reports.

sec-report