The Agent Skills Directory

[SAFE]: The primary script, scripts/assemble-bundle.mjs, is a zero-dependency Node.js utility that performs file organization, hashing, and manifest generation locally within the agent's environment.
[DATA_EXPOSURE]: The skill instructions provide specific guidance on excluding pseudonymization maps (PII) from audit bundles to comply with RODO (GDPR) requirements, promoting secure handling of sensitive legal data.
[COMMAND_EXECUTION]: The script uses standard node:fs modules to copy files and create directories based on a provided descriptor. These operations are within the scope of the skill's allowed-tools (Read, Write, Bash).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data through a JSON descriptor. 1. Ingestion points: descriptor.json read in scripts/assemble-bundle.mjs. 2. Boundary markers: None. 3. Capability inventory: The script performs mkdirSync, copyFileSync, writeFileSync, and readFileSync in scripts/assemble-bundle.mjs. 4. Sanitization: The script uses basename() for destination paths to prevent directory traversal outside the bundle target.
[EXTERNAL_DOWNLOADS]: The skill references established patterns from Microsoft and ICME for audit logs as roadmap inspiration but does not download or execute remote code at runtime.

legal-ai-audit-bundle