The Agent Skills Directory

[SAFE]: The skill provides tools for metrology and scientific calculations. Security analysis indicates the implementation is defensive: it uses an abstract syntax tree (AST) walker with a strict whitelist in _common.py to evaluate user-supplied expressions safely, avoiding eval() or exec(). File I/O is restricted to local paths, specifically rejecting network URLs and symlinks, and employs atomic writes with restricted permissions (0o600). No malicious patterns such as credential theft or exfiltration were found.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides data processing and auditing surfaces. 1. Ingestion points: Python source files via audit_units.py and JSON/expression inputs via calculation tools. 2. Boundary markers: The skill produces structured output (JSON/Markdown) but does not include explicit boundary markers for the data it processes. 3. Capability inventory: Includes local file read/write capabilities (in _common.py) but lacks network access or arbitrary command execution. 4. Sanitization: Expressions are sanitized via AST parsing and whitelisting. This surface is inherent to the auditing use-case and is mitigated by the tool's restricted execution model.

uncertainty-and-units