The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/provenance_core.py contains a utility function run_tool that uses subprocess.Popen to invoke external verifiers. However, this functionality is not utilized by the skill's main entry point scripts/check_transparency.py, which only performs static JSON validation. Furthermore, the subprocess call uses shell=False and constructs the command list from safe components, effectively mitigating command injection risks.
[DATA_EXPOSURE]: The script scripts/check_transparency.py reads a local JSON file provided as a command-line argument to evaluate transparency gaps. This file access is limited to the user-specified path and the data is processed entirely locally without any network exfiltration or unauthorized file system writes.
[INDIRECT_PROMPT_INJECTION]: The skill processes a JSON file containing AI transparency records. The implementation mitigates injection risks by using json.load for structured parsing and applying strict validation (regular expressions and type checking) to all fields before outputting the evaluation result.

check-ai-transparency