The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from finding files, OWASP reports, and Rules of Engagement (ROE) documents to generate a summary. While this creates a potential surface for indirect prompt injection if the source data is maliciously crafted, the processing logic is deterministic and output is intended for human review.
Ingestion points: engagements/*/findings/all-with-owasp.jsonl, engagements/*/reports/owasp-coverage.md, and engagements/*/roe.yaml via scripts/exec_summary.py.
Boundary markers: The generated Markdown report does not use specific delimiters to isolate interpolated content from the report structure.
Capability inventory: The skill uses Read, Write, and Bash(python3) tools to read input files and write the final Markdown report.
Sanitization: The script correctly uses json.loads() and yaml.safe_load() for parsing structured input data, preventing unsafe deserialization attacks.
[COMMAND_EXECUTION]: The skill uses Python 3 to execute its reporting script. The allowed-tools configuration is appropriately scoped to python3, Read, Write, and Glob, while explicitly disallowing dangerous commands such as curl, wget, and rm.
[DATA_EXFILTRATION]: No network operations or unauthorized data transmission patterns were identified. The skill operates exclusively on local engagement artifacts.

generating-executive-summary