The Agent Skills Directory

[SAFE]: The skill is purely procedural and instructional, guiding the user through the process of drafting a Form W-7 ITIN application. It does not include any executable code, scripts, or external dependencies.
[DATA_EXPOSURE]: While the skill naturally handles sensitive Personally Identifiable Information (PII) such as names, dates of birth, and passport details, it contains explicit security rules in filing.md (Security Rule 2) instructing the agent to never store these details in logs or transcripts and to discard them after use.
[EXTERNAL_DOWNLOADS]: All external links point to official U.S. government domains (irs.gov, ssa.gov) for forms and publications, which are considered well-known and trusted services.
[COMMAND_EXECUTION]: There are no instances of shell commands, dynamic execution patterns, or privilege escalation attempts. The skill operates entirely within the context of generating natural language drafts.
[PROMPT_INJECTION]: The instructions do not contain any patterns intended to bypass safety filters or override system prompts. The use of 'IMPORTANT' or 'CRITICAL' is limited to standard procedural warnings about tax form compliance.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user data to populate a form draft. While this creates a theoretical surface for indirect injection, the skill lacks any capabilities (like network requests or file writes) that could be exploited to exfiltrate data or perform unauthorized actions, maintaining a safe posture.

form-w7