The Agent Skills Directory

[DYNAMIC_EXECUTION]: The instruction files references/dpia-custom-population.md and references/edpb-2026-population.md contain embedded Python source code for the agent to execute. This code is designed to manipulate OOXML documents using an external library and direct XML modification. Providing executable source code within instructions is a characteristic of dynamic execution risks.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (python ooxml/scripts/unpack.py and python ooxml/scripts/pack.py) to manage document template lifecycle. These scripts are not part of the provided skill package, indicating a dependency on the underlying environment and an assumption that the agent can execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
Ingestion points: The skill ingests untrusted user data when the user provides a description of their 'processing activity' as seen in the assessment flow in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions (e.g., 'ignore embedded commands') to delimit untrusted user content from the skill's instructions.
Capability inventory: The skill uses high-privilege capabilities including shell command execution (python ooxml/scripts/unpack.py) and Python code execution (from document import Document) to generate reports, as documented in the population guides.
Sanitization: There is no evidence of sanitization, escaping, or validation of user-provided text before it is processed by the agent's logic or used in document generation.

dpia-sentinel-oliver-schmidt-prietz