The Agent Skills Directory

[SAFE]: The skill provides legitimate business logic for revenue forecasting and churn analysis without security vulnerabilities.
[REMOTE_CODE_EXECUTION]: Evaluation of revenue_forecast_model.py and churn_analyzer.py shows that the code relies exclusively on the Python standard library. It does not import untrusted modules or execute remote code.
[DATA_EXFILTRATION]: The skill does not contain hardcoded credentials, sensitive file paths, or network operations that could facilitate data exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill includes an ingestion surface for untrusted data via CSV processing in the forecasting and churn scripts, and via company-context.md in SKILL.md. However, an inventory of the skill's capabilities reveals a total absence of dangerous operations such as subprocess spawning, file writes, or network requests, effectively neutralizing the risk despite the absence of explicit boundary markers or sanitization.

cro-advisor