The Agent Skills Directory

[SAFE]: The skill processes customer feedback data which may be sensitive, but it incorporates extensive privacy protections in references/privacy-and-quote-integrity.md. These include instructions for local processing, redaction of personal identifiers, and strict management of consent states (e.g., 'internal-only' vs 'publishable').
[SAFE]: The execution of Node.js scripts (scripts/generate_report.mjs and scripts/export_ledger.mjs) is restricted to local files included with the skill. These scripts use only standard Node.js built-in modules (node:fs/promises, path) and have no external dependencies.
[SAFE]: The HTML report generation script includes a dedicated esc() function that sanitizes all data before it is interpolated into the template. This effectively mitigates the risk of Cross-Site Scripting (XSS) if malicious or malformed text is present in the customer feedback data.
[SAFE]: The skill addresses potential Indirect Prompt Injection by enforcing 'Evidence Integrity' in SKILL.md. It requires the agent to maintain a ledger where quotes are kept verbatim and distinct from interpretation, and demands traceability via IDs for every claim, which prevents untrusted data from overriding the agent's analytical instructions.
[SAFE]: Network operations are not used in the provided scripts or instructions. The skill operates entirely on supplied files and exports artifacts to a local outputs/ directory.

analyze-startup-feedback