The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (risk_assessment.py, compliance_checker.py) that perform local processing of CSV/JSON data. The commands demonstrated in the SKILL.md are standard execution patterns for the provided local scripts and do not involve shell injection or dangerous system calls.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data in the form of asset inventories (CSV) and control implementation statuses. While this represents a data ingestion surface, the processing logic is strictly procedural (risk calculation and compliance mapping) and does not involve interpolation into LLM prompts in a way that could trigger instruction override.- [DATA_EXPOSURE]: The scripts read from local files (assets.csv, controls.csv) and write to local files (risk_register.json, gaps.md). There are no network operations, hardcoded credentials, or access to sensitive system paths like .ssh or .aws.- [DYNAMIC_EXECUTION]: The Python scripts use standard library functions for data processing. While compliance_checker.py uses random.seed(hash(control_id)) to simulate implementation status when data is missing, it does not involve eval(), exec(), or dynamic loading of external code.- [METADATA_POISONING]: The skill metadata (name, description, tags) accurately reflects the functionality provided in the scripts and documentation. No deceptive instructions were found in the metadata fields.

information-security-manager-iso27001