The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/provenance_core.py (vendored from a shared core) utilizes subprocess.Popen to call local CLI tools such as c2patool. The implementation correctly uses shell=False and a list for arguments, which is a standard security best practice to prevent command injection.
[PROMPT_INJECTION]: The skill processes untrusted metadata from various file formats (SVG, PDF, images), creating a potential surface for indirect prompt injection.
Ingestion points: scripts/audit_metadata.py reads user-provided asset files through multiple format-specific parsers.
Boundary markers: The skill outputs results in a structured JSON format and provides clear audit boundaries in the SKILL.md and references/privacy-boundaries.md files.
Capability inventory: The skill possesses file-read access and the capability to execute specific local binaries for provenance verification.
Sanitization: The tool implements a strict redaction policy, identifying the category and location of sensitive data without interpolating the raw, untrusted values into the prompt context.
[SAFE]: The skill is explicitly read-only and designed to audit privacy risks without mutating assets or exfiltrating data. It focuses on identifying known privacy-sensitive metadata fields and includes logic to detect hidden covert channels like zero-width characters and homoglyphs in the processed data.

audit-metadata-privacy