The Agent Skills Directory

[SAFE]: The skill is a non-invokable support library designed for offline data validation and score replay. It does not perform network operations, hard-code credentials, or execute arbitrary remote code.\n- [SAFE]: Implements a security manifest (manifest.json) and SHA-256 hashing to verify the integrity of schemas and scripts, protecting against local tampering.\n- [SAFE]: Includes a portable_bundle feature in scripts/contracts.py that projects data by hashing sensitive fields (identifiers, provider details, timestamps) rather than exporting them in plain text, reducing the risk of accidental data exposure.\n- [SAFE]: The core validation logic in scripts/contracts.py explicitly defends against TOCTOU (Time-of-Check Time-of-Use) attacks by injecting verified schema bytes into the module at execution time rather than re-reading files from disk after they have been hashed.\n- [SAFE]: Subprocess usage detected by static analysis is confined to tests/test_packaging.py for verifying installation layouts and integrity check failures, presenting no risk to the runtime environment.

jev-evidence