The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install the license-comply package via pip install. The package is attributed to an external author ("Sam Clearwater") and its provenance is not verified within the context of trusted or well-known organizations.
[COMMAND_EXECUTION]: The skill uses the license-comply scan command to perform directory-level scanning of the local project. While this is the intended functionality, it involves executing a third-party CLI tool with access to local file content.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through its "AI executive summary" feature. This feature processes data from untrusted local project files, such as requirements.txt or pyproject.toml, which could contain malicious instructions designed to influence the AI's output.
Ingestion points: Project configuration files and dependency lists (requirements.txt, pyproject.toml) found in the scanned directory.
Boundary markers: No specific delimiters or "ignore instructions" warnings are identified for the data ingested from project files.
Capability inventory: The skill generates advisories, remediation steps, and an "AI executive summary" using an LLM, and it outputs reports in multiple formats (HTML, Markdown, CSV, JSON).
Sanitization: The instructions do not mention any sanitization or validation of the license strings or package names extracted from the processed files before they are interpolated into the prompt for summary generation.

license-comply