The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes user-provided legal text and audit results to populate the generated reports. This workflow creates an exposure surface for indirect prompt injection. To mitigate this, the skill implements explicit sanitization logic in its generation scripts, specifically using the htmllib.escape function in scripts/generate_site.py for HTML output and a custom tex_escape regex-based function in scripts/generate_latex.py for LaTeX output, ensuring user-supplied strings are treated as data.
[COMMAND_EXECUTION]: The skill utilizes bundled Python scripts to perform its core report generation. These scripts are invoked locally by the agent and are restricted to using the Python standard library. The scripts perform file system operations only within the caller-defined output directory, maintaining a secure and predictable operational scope.
[EXTERNAL_DOWNLOADS]: The website rendering logic includes references to Google Fonts. This is a standard practice for web applications and involves a well-known service for asset delivery, which is documented in the skill's NOTICE and resources files.

ambiguity-report