The Agent Skills Directory

[SAFE]: No security issues detected.
[COMMAND_EXECUTION]: The skill includes a local script scripts/calculate.py for performing financial math. This script is deterministic, uses only standard libraries (math, statistics), and contains no dangerous subprocess calls or shell execution patterns.
[DATA_EXPOSURE]: There is no evidence of the skill attempting to access sensitive directories (like .ssh or .aws) or exfiltrate data. It strictly processes numerical return data provided in the evals/files/ directory.
[EXTERNAL_DOWNLOADS]: The skill references informational content from well-known financial education platforms such as Investopedia and the Corporate Finance Institute (CFI). These references are for documentation purposes and do not involve executable code downloads.
[INDIRECT_PROMPT_INJECTION]: The skill processes external CSV data for volatility modeling. Analysis of the capability surface shows that the processing script (calculate.py) is restricted to mathematical operations with no network, file-write, or execution capabilities, rendering the attack surface negligible.

risk-assessment