The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the execute_skill_script_file tool to run internal Python scripts (extract_financials.py, calculate_ratios.py, generate_charts.py). This is a secure execution model that limits commands to specific files within the skill's own directory and avoids direct shell interaction.
[DATA_EXFILTRATION]: The skill accesses local document files provided by the user for financial analysis. This operation is localized to the Python execution environment, and no network calls or unauthorized access to sensitive system paths were identified.
[INDIRECT_PROMPT_INJECTION]: The skill processes external financial data, presenting an attack surface for indirect prompt injection.
Ingestion points: Financial reports (PDF/Text) are read in scripts/extract_financials.py.
Boundary markers: The skill uses a structured JSON extraction process and an HTML template with specific placeholders to delimit data.
Capability inventory: The skill has file-reading and local file-writing (chart images) capabilities.
Sanitization: Data is sanitized by passing through regular expression filters that extract only specific numeric and financial line items before analysis.
[DYNAMIC_EXECUTION]: The skill makes use of standard libraries like matplotlib for chart generation and pdfplumber for document parsing. These libraries are used for their intended analytical purposes and do not involve loading or executing code from untrusted external sources.

financial-report-analyzer