The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several Python scripts (convert_to_csv.py, parse_csv.py, etc.) that act as wrappers to call core processing scripts (convert_formats.py, parse_formats.py) using subprocess.call. These are used for internal orchestration of format conversions (Word, Excel, PDF, JSON, CSV).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external requirement documents, user stories, and prototypes. This creates an attack surface where malicious instructions embedded in these documents could attempt to influence the agent's behavior during the analysis phase.
Ingestion points: Files like SKILL.md and prompts/requirements-analysis.md define inputs such as requirement docs, stories, and change requests.
Boundary markers: The skill uses section headers (e.g., 'Requirement Understanding', 'Gaps and Ambiguities') to structure output but lacks explicit 'ignore embedded instructions' delimiters for raw data.
Capability inventory: The skill performs file reading and format conversion via internal scripts but does not have network-write capabilities.
Sanitization: There is no evidence of specific input sanitization for Natural Language instructions in the ingested documents.
[PRIVILEGE_ESCALATION]: The README.md provides installation instructions for Windows that recommend running PowerShell with -ExecutionPolicy Bypass. While common for developer tools, this explicitly instructs the user to bypass a local security policy.

requirements-analysis