The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/tax_rule_updater.py fetches tax rule data from official German Ministry of Finance (BMF) domains. This is used to keep the bundled tax logic current with official legislation.- [COMMAND_EXECUTION]: The skill uses subprocess.run within its update pipeline to execute standard Python verification tools, such as unittest and compileall, ensuring the integrity of rule updates before they are proposed to the user.- [DYNAMIC_EXECUTION]: The update mechanism in scripts/tax_rule_updater.py can generate patches for the skill's local logic files (tax_rules.py, tax_dates.py). This process is transparent and relies on a proposal-and-approval workflow requiring explicit user confirmation.- [DATA_STORAGE]: User profile data, receipt logs, and tax claims are stored strictly in a project-local directory (.taxde/), ensuring data remains under the user's control within the project workspace.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documents (PDFs and images) provided by the user using OCR and PDF extraction tools. This creates an attack surface for instructions embedded within document text.
Ingestion points: Untrusted text is extracted from files in scripts/document_sorter.py using pytesseract and pdfplumber.
Boundary markers: None; extracted text is analyzed by the agent without specific delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has permissions to write to the project directory, rename files, and perform network reads from hardcoded official URLs.
Sanitization: No sanitization of the extracted document text is performed prior to processing by the AI agent.

taxde