The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/ig-stats.py uses tarfile.extractall() to unpack Implementation Guide packages without validating the file paths within the archive. This implementation is vulnerable to directory traversal (ZipSlip/TarSlip) attacks, where a malicious package could overwrite arbitrary files on the system using filenames containing ../ sequences.
[EXTERNAL_DOWNLOADS]: The run command in scripts/ig-stats.py fetches data from arbitrary user-provided URLs using urllib.request.urlretrieve and git clone. While this enables the analysis of remote repositories, it introduces risks associated with interacting with untrusted servers and downloading potentially malicious project files.
[PROMPT_INJECTION]: The skill processes external documentation and narrative pages which creates a surface for indirect prompt injection. A malicious Implementation Guide could contain instructions designed to influence the agent's behavior when it reads the analysis report.
Ingestion points: Markdown and FSH files within the Implementation Guides processed by scripts/ig-stats.py in the analyze function.
Boundary markers: Absent; the script extracts text from narrative pages without using delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has network access (cloning/downloading) and local file system access (writing reports and source directories).
Sanitization: The script performs word counts and regex-based metric extraction but does not sanitize or filter the content of the narrative pages it processes.

fhir-ig-analyze