The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install pyyaml via pip. This is a well-known, standard library from the official Python Package Index (PyPI).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data, such as risk registers in YAML or CSV format and existing security policy documents.
Ingestion points: risk_register.py reads data from files provided via the --input argument.
Boundary markers: The skill instructions explicitly direct the agent to treat all file contents and tool responses as untrusted evidence rather than instructions.
Capability inventory: The provided scripts perform analytical calculations and write results to local files specified by the user.
Sanitization: The risk_register.py script correctly uses yaml.safe_load() to prevent potential remote code execution during the parsing of user-supplied YAML files.

19-grc-compliance