The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local Python scripts for template generation and structure validation. These scripts use a centralized helper module (scripts/_common.py) that enforces strict security boundaries by prohibiting symbolic links, non-local paths (URLs/URIs), and excessive file sizes, effectively mitigating potential path traversal or resource exhaustion attacks.
[DATA_EXFILTRATION]: No network-capable code is present. The skill manually implements a _reject_nonlocal function in its core logic to prevent the use of URLs or network-mapped paths. It operates exclusively on de-identified or synthetic data supplied as local files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of CSV and JSON manifests. It mitigates injection risks by using structured data parsing, enforced schema validation, and sanitization of input labels to prevent markup injection or schema confusion during the generation of Markdown reports.
[DYNAMIC_EXECUTION]: All validation logic is deterministic and uses standard library components. There is no use of eval(), exec(), or dynamic module loading. Input files are parsed as static data only.

clinical-reports