The Agent Skills Directory

[Secure Data Processing]: The skill implements text extraction for DOCX, PPTX, XLSX, and CSV formats using only Python's standard library components (e.g., zipfile and xml.etree). This approach avoids external dependencies and minimizes the potential for supply chain vulnerabilities.
[Network Security Measures]: The URL auditing functionality includes proactive security checks to prevent Server-Side Request Forgery (SSRF). The validate_public_url function ensures that the agent only accesses global, public IP addresses and prevents interaction with internal or private network ranges.
[Limited Execution Scope]: The Python scripts are focused on text parsing and pattern matching. They do not utilize dangerous functions such as eval(), exec(), or subprocess for processing extracted content, effectively mitigating risks associated with dynamic code execution.
[Indirect Prompt Injection Surface]: While the skill processes untrusted external content (files and web pages), the agent's role is restricted to reviewing and auditing text based on provided reference documents. The absence of destructive capabilities (like file writing or shell access) ensures that any potential injection through processed data remains low-risk.

global-greenwashing-claim-auditor