The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/gov_bid_api.py contains a hardcoded authentication token (API_KEY = "c25c774b2b1d4e15adfd0a1ebded3adb") used for all requests to the gov-bid.com API.
[COMMAND_EXECUTION]: The skill executes file system operations in scripts/report_generator_patch.py to write generated HTML reports directly to the user's desktop (~/Desktop/). It also includes instructions in SKILL.md (Step 6) to start a local HTTP server to serve these reports, which modifies the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted technical descriptions and external data to generate a report.
Ingestion points: Technical descriptions from users, patent data from the patent.search tool, and bidding data from the gov-bid.com API.
Boundary markers: None. The technical content is processed without delimiters or guardrail instructions to the agent to ignore embedded commands.
Capability inventory: The skill can perform network operations via the requests library and has write access to the user's desktop directory.
Sanitization: While scripts/report_generator_patch.py performs basic character filtering on the filename, the actual technical content used to populate the HTML report in scripts/report_generator.py is interpolated into the template without sanitization or escaping.

tech-transfer-match