The Agent Skills Directory

[PROMPT_INJECTION]: The skill's instructions are focused on proactive tax notification and grounding calculations in provided reference files. No patterns of jailbreaking, system prompt extraction, or safety filter bypass were detected.
[DATA_EXFILTRATION]: The skill requests sensitive business information (turnover, tax regime, employee count) to perform its functions. However, analysis of the provided Python scripts confirms that no network operations, external API calls, or unauthorized file-writing tasks are performed. All data processing occurs locally.
[REMOTE_CODE_EXECUTION]: The skill executes a local Python script (scripts/tax_calc.py). This script relies exclusively on Python's standard library and local vendor-provided data files. It does not download external scripts or execute commands from remote sources.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it is designed to process CSV exports from banking clients.
Ingestion points: CSV file uploads and manual user input specified in the 'Compatibility' section of SKILL.md.
Boundary markers: None explicitly defined in the LLM instructions for separating data from instructions.
Capability inventory: The skill executes scripts/tax_calc.py via shell command, but the script is restricted to mathematical operations and data validation.
Sanitization: The Python script uses argparse with strict type casting (type=float, type=int), which prevents command injection through the calculation parameters.

tax-calendar-proactive