The Agent Skills Directory

[SAFE]: The skill is a standard compliance toolkit. All scripts and documentation align with the stated purpose of managing NIST RMF authorizations. No suspicious network activity or hardcoded credentials were found.
[COMMAND_EXECUTION]: The skill uses scripts/process.py for automated data rendering. The script is limited to local file processing using Python's standard library and does not include any dangerous functions such as eval(), exec(), or subprocess.run().
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its data ingestion process. The process.py script accepts JSON input that is subsequently rendered into Markdown tables, which could potentially be used to inject instructions into an agent's context if the input data is untrusted.
Ingestion points: scripts/process.py reads system data from a file specified via the --input flag.
Boundary markers: None; external data is interpolated directly into Markdown report templates.
Capability inventory: File read/write operations; the skill does not have access to sensitive system commands or network tools.
Sanitization: Input validation is performed on categorization levels (e.g., Low/Moderate/High), but there is no escaping or filtering of characters in descriptive text fields.

executing-nist-rmf-authorization-to-operate