The Agent Skills Directory

[SAFE]: The skill is well-defined and focused on its stated purpose of assisting with GDPR Article 33-34 compliance. Its operations are restricted to the local environment.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Python script scripts/gdpr_deadlines.py. This script performs deterministic date calculations using only Python's standard library (datetime, calendar, argparse). It does not perform network requests, file system modifications, or access sensitive user data.
[EXTERNAL_DOWNLOADS]: No external code, packages, or remote resources are fetched. The Python script is documented as having zero dependencies.
[PROMPT_INJECTION]: The instructions do not contain patterns attempting to bypass safety filters or override agent behavior.
[DATA_EXFILTRATION]: There are no network operations or sensitive file access patterns (such as accessing SSH keys or AWS credentials) detected in the instructions or the script.
[INDIRECT_PROMPT_INJECTION]: While the skill is designed to process external data (descriptions of data breaches), it acts as a drafting assistant. The attack surface is minimal as it primarily performs date arithmetic and template filling without recursive tool execution on untrusted input.

gdpr-breach-72h-en