The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python scripts such as batch_convert_templates.py and convert_formats.py to orchestrate file processing tasks. These scripts utilize subprocess.call with argument lists and sys.executable, which is a secure pattern that prevents shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data by processing various document formats (XLSX, DOCX, CSV) via scripts like parse_formats.py. However, the risk is mitigated by the skill's capability inventory, which is restricted to local file read/write operations without any network access for exfiltration.
[PRIVILEGE_ESCALATION]: The README.md installation instructions for Windows recommend using the -ExecutionPolicy Bypass flag for PowerShell. While this is a standard practice for executing local developer scripts, it involves bypassing a system security policy during the setup phase.

sprint-testing-workflow