The Agent Skills Directory

[SAFE]: The skill operates entirely locally using bundled Python scripts that rely solely on the Python standard library. No external package installations or remote code downloads were identified.
[SAFE]: File operations implement security hardening through atomic writes and symlink protection. scripts/common.py uses tempfile.mkstemp and os.replace to prevent race conditions and symlink attacks during file output.
[SAFE]: Resource governance is established for subprocesses. The subprocess_rlimits function in scripts/common.py restricts address space and file size limits for child processes on POSIX systems, mitigating potential resource exhaustion (DoS) when processing large or malformed files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content as its primary function, which presents an attack surface for indirect prompt injection. This is mitigated through explicit architectural choices:
Ingestion points: Untrusted data enters the skill via file paths or stdin processed by scripts/inspect_text.py and scripts/clean_text.py.
Boundary markers: SKILL.md provides strict instructions to the agent to protect code blocks (fenced and inline), URLs, identifiers, and API names from modification, isolating executable or sensitive strings from the rewrite logic.
Capability inventory: The skill's capabilities are limited to local text analysis and transformation; it possesses no network capabilities or high-privilege system access.
Sanitization: The core of the skill is a deterministic sanitization engine (scripts/text_unicode.py) that identifies and strips invisible Unicode carriers, homoglyphs, and other steganographic artifacts that could be used for prompt leakage or obfuscation.

clean-user-facing-text