The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied CSV files for maturity scoring, which represents a potential surface for indirect prompt injection if an attacker were to include malicious instructions within the 'evidence' or 'notes' fields of an assessment file.
Ingestion points: scripts/agent.py (via --csv input) and scripts/process.py (via scores data structure) read external assessment data.
Boundary markers: Absent; the scripts do not implement specific delimiters or 'ignore' instructions for the processed data fields.
Capability inventory: The skill is restricted to local file system read/write operations and console output; it lacks network access or privilege escalation capabilities.
Sanitization: Partial; maturity scores are strictly converted to integers, effectively sanitizing numeric input, though descriptive text fields are processed as raw strings.
[EXTERNAL_DOWNLOADS]: The skill references official NIST documentation and cybersecurity benchmarking tools from established domains including csrc.nist.gov and csf.tools. These references are standard for the cybersecurity assessment use-case and point to trusted information sources.

performing-nist-csf-maturity-assessment