The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were identified in the skill. The logic is consistent with the stated purpose of data transformation.
[COMMAND_EXECUTION]: The skill uses shell scripts (run.sh, test.sh) to execute the expanso command-line tool and perform configuration validation using yq or python3.
[EXTERNAL_DOWNLOADS]: The skill references documentation and examples from the vendor's official domain (expanso.io) and suggests installation via the vendor's package manager.
[PROMPT_INJECTION]: Indirect prompt injection surface evaluation:
Ingestion points: The pipeline.yaml file defines an HTTP server input at 0.0.0.0:8080/transform that accepts external data via POST requests.
Boundary markers: No explicit prompt delimiters are present, as the skill is designed for automated data processing rather than conversational interaction.
Capability inventory: Capabilities are restricted to data transformation (JSON/XML/CSV parsing and encoding) within the Expanso engine; no arbitrary shell execution or network requests are triggered by the processed data.
Sanitization: The pipeline uses strict structural parsing (JSON/XML/CSV) which serves as a natural barrier against non-conforming data payloads.

expanso-transform-formats