The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected. The skill is designed with an 'assume-malicious' posture toward its own inputs, implementing robust local-only audit tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted research text from datasets, hypotheses, and results, which is an inherent attack surface for indirect prompt injection. This risk is thoroughly mitigated by design.
Ingestion points: Data enters the agent's context through JSON/YAML files processed by scripts/audit_dataset.py, scripts/inspect_outputs.py, and scripts/evaluate_local.py.
Boundary markers: Instructions in SKILL.md and references/security.md explicitly direct the agent to treat external content as opaque data and ignore any embedded instructions.
Capability inventory: The skill uses local Bash commands for validation and Write/Edit for local configuration management.
Sanitization: Bundled scripts use strict schema validation, content hashing for reports, and comprehensive path checks (rejecting traversal, symlinks, and root escapes) to prevent data misuse.
[DYNAMIC_EXECUTION]: A static detector flagged yaml.load() in scripts/_common.py. This is a false positive, as the code uses a custom UniqueSafeLoader inheriting from yaml.SafeLoader, which is the recommended secure way to parse YAML without executing arbitrary objects.
[DATA_EXPOSURE]: The skill manages environment variable names for LLM providers (e.g., OPENAI_API_KEY) but includes specific protections. The named_env_presence function only returns a boolean indicating presence and never exposes the value, and the scripts include a secret-detection regex to block accidental inclusion of API keys in configuration files.

hypogenic