The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill is designed to ingest and interpret arbitrary CSV files provided by the user (e.g., Black Duck exports). This presents an indirect prompt injection surface where malicious instructions embedded in the CSV data could attempt to influence the agent's behavior.
Ingestion points: The agent reads content from the file path specified in the csv-path parameter in SKILL.md.
Boundary markers: The instructions do not explicitly define boundary markers for the raw CSV content when it is being interpreted by the LLM.
Capability inventory: The skill possesses the capability to execute local shell and PowerShell scripts (report_tools.sh and report_tools.ps1) to perform lookups and validation.
Sanitization: The skill mitigates risks by requiring the final output to pass a structural and consistency validation check against a strict JSON schema.
[Local Command Execution]: The skill utilizes local helper scripts (scripts/report_tools.sh and scripts/report_tools.ps1) to perform deterministic tasks like solution mapping and schema validation. The agent is instructed to invoke these scripts via the command line, which is a standard pattern for extending agent capabilities with local tooling.
[Dynamic Execution in Testing]: The test suite (tests/test_report_tools.py) uses Python's subprocess.run to verify the behavior of the helper scripts across different interpreters (Bash and PowerShell). While this involves shell command execution, it is restricted to the testing environment and is used to ensure the reliability of the deployment tools.

assessment-report-converter