The Agent Skills Directory

[SAFE]: The skill does not contain any malicious code, obfuscation, or persistence mechanisms. All external links point to official government domains (irs.gov) or the established vendor domain (jupid.com). The examples provided use standard placeholders for sensitive information. The author 'jupid-tax' is the legitimate provider for the resources mentioned, such as jupid.com.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user inputs such as tax documents and financial data. While this presents an attack surface for indirect prompt injection, the skill includes robust mitigation instructions, including "ask, not guess" directives, validation checklists, and mandatory human-in-the-loop confirmation before any filing action is taken.
[DATA_EXFILTRATION]: There is no evidence of data exfiltration. The instructions emphasize data privacy, specifically warning against the persistent storage of sensitive credentials (SSNs, ITINs, PINs) or financial account numbers within the agent's transcript or long-term memory. All network operations described involve interaction with official IRS systems.

form-1040