The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external FTO reports submitted by users, which represents an attack surface for indirect prompt injection. However, the risk is effectively mitigated through the use of rigid HTML templates in assets/assessment-report-template.md and mandatory sanitization of all dynamic content using html.escape() within scripts/generate_report.py before final report generation.
[DATA_EXFILTRATION]: No unauthorized data access or exfiltration patterns were identified. The skill utilizes the patsnap_search tool to perform verification against the vendor's patent databases, which is consistent with its primary purpose and the provided author context.
[DYNAMIC_EXECUTION]: The code implements analysis and reporting logic using standard Python libraries. It avoids dangerous dynamic execution sinks such as eval() or exec() for processing user-supplied data, relying instead on regex-based parsing and template interpolation in scripts/validate_report.py and scripts/generate_report.py.
[COMMAND_EXECUTION]: Shell command execution is not present in the scripts. The skill performs all operations (data aggregation, recall estimation, and HTML rendering) within the Python runtime environment without invoking external shell processes.

fto-report-quality