The Agent Skills Directory

[SAFE]: The skill implements standard mathematical workflows for design of experiments (DOE) and optimization. All behavior matches the stated purpose of calibrating simulation parameters.- [METADATA_POISONING]: There is a minor documentation discrepancy between the stated requirements and the actual code. SKILL.md and CHANGELOG.md claim the skill uses only the Python standard library, but scripts/surrogate_builder.py imports and requires the 'numpy' package for polynomial fits. This is documented as a neutral finding since numpy is a well-known, trusted library and its use does not introduce security risks beyond the dependency requirement itself.- [INDIRECT_PROMPT_INJECTION]: The skill has a minimal attack surface for indirect injection. It ingests user-provided parameter names and numeric values via CLI arguments. Sensitivity_summary.py implements robust sanitization, validating names against a strict regular expression ([a-zA-Z_][a-zA-Z0-9_ .-]*), enforcing a 200-character length limit, and capping list lengths at 10,000 to prevent resource exhaustion or command injection via crafted identifiers.- [COMMAND_EXECUTION]: All scripts use the argparse library for input handling and do not invoke subprocesses or shell commands. The tool access is correctly restricted to file operations (Read, Write, Grep, Glob) and excludes Bash, aligning with the principle of least privilege.

parameter-optimization