The Agent Skills Directory

[SAFE]: The skill and its associated reference files consist of professional business guidance and analytical logic. No prompt injection attempts, malicious instructions, or obfuscation techniques were identified across the 6 analyzed files.
[COMMAND_EXECUTION]: The skill provides two Python tools, scripts/revenue_forecast_model.py and scripts/churn_analyzer.py, which are intended for local data processing. Analysis of these scripts confirms they rely strictly on the Python standard library (such as csv, json, argparse, and statistics) and do not contain functions for network access, file system modification beyond reading inputs, or dynamic code execution.
[PROMPT_INJECTION]: The skill is designed to ingest data from company-context.md and user-supplied CSV files to provide tailored business advice. While this represents a surface for indirect prompt injection, it is the primary intended function of the skill and is implemented through structured data parsing in the provided tools. Evidence: 1. Ingestion points: company-context.md and CSV pipeline/customer data. 2. Boundary markers: Not explicitly defined in SKILL.md. 3. Capability inventory: Local script execution via the python tool for mathematical modeling. 4. Sanitization: The analytical scripts parse CSV input into specific types like floats and dates, which effectively validates numeric inputs.

cro-advisor