The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts tag_relevant.py and generate_report.py use importlib.util to dynamically load and execute Python configuration files from a directory based on the tech_topic variable provided as a command-line argument. Dynamic loading and module execution from computed paths is a security concern if the input is not strictly validated.
[INDIRECT_PROMPT_INJECTION]: The skill processes patent data from external Excel files and embeds it into HTML reports, creating an attack surface where malicious instructions could be embedded in patent fields. 1. Ingestion points: Excel files containing patent metadata are read in tag_relevant.py and generate_report.py. 2. Boundary markers: No explicit delimiters or 'ignore' instructions are used in the generated HTML to isolate untrusted content. 3. Capability inventory: The skill has file system read/write access and can perform network downloads. 4. Sanitization: No specific sanitization or filtering of the Excel data is performed before it is interpolated into the HTML output.
[EXTERNAL_DOWNLOADS]: The generate_report.py script fetches a background image from images.unsplash.com to style the generated report. This uses a well-known image hosting service for legitimate cosmetic purposes and does not pose a direct threat.

tech-report-skill