The Agent Skills Directory

[SAFE]: The skill defines a set of Python classes for security auditing, including audit scope management, control assessment, and reporting. The code is entirely declarative or utilizes unimplemented placeholder methods for internal logic, presenting no functional security risk.
[INDIRECT_PROMPT_INJECTION]: The skill contains data ingestion points for audit findings and evidence, which represents a theoretical attack surface for indirect prompt injection. However, the lack of system-level capabilities (network, file system, or subprocess execution) renders this surface non-exploitable.
Ingestion points: Untrusted data enters the context via AuditScope.add_system (description), ControlAssessment.test_control (evidence), and AuditReport.add_finding (title, description, evidence) in SKILL.md.
Boundary markers: No delimiters or boundary markers are present to isolate user-provided data from agent instructions.
Capability inventory: The skill does not define any capabilities for file writing, network operations, or shell command execution.
Sanitization: No input validation or sanitization logic is implemented for the processed strings.

security-auditing