The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches fiscal and corporate data from trusted or well-known external sources to ensure compliance.
Evidence: SKILL.md and scripts/update_data.py reference data sourced from github.com/arrhes/PCG (Plan Comptable Général) and data.gouv.fr (nomenclature fiscale).
Evidence: Instructions in SKILL.md direct the agent to consult official domains such as impots.gouv.fr, urssaf.fr, and service-public.fr to verify tax rates and thresholds.
[COMMAND_EXECUTION]: The skill makes extensive use of local scripts for core accounting functions, which is standard for deterministic financial operations.
Evidence: SKILL.md lists several scripts for calculations and document generation, such as scripts/calc.js (TVA/IS/amortissements), scripts/generate-fec.js, and scripts/generate-facturx.js.
Evidence: references/facturation/stripe-sync.md describes the use of import-stripe-invoices.js and upload-qonto-attachments.js to automate financial workflows.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (transaction records and invoices), creating a potential surface for indirect injection if descriptions or metadata contain malicious instructions.
Ingestion points: data/transactions/qonto-*.json, data/transactions/stripe-*.json (as described in references/arborescence.md), and XML invoice files processed by scripts/parse-einvoice.js.
Boundary markers: The skill mitigates risks by using structured data formats (JSON, XML, CSV) and dedicated parsing scripts rather than direct natural language interpretation of external data.
Capability inventory: The agent can perform network requests to Stripe and Qonto APIs, execute local Python and Node.js scripts, and write files (PDFs, FEC text files, and financial statements).
Sanitization: The skill relies on the inherent structure of the ingested data and the deterministic nature of the processing scripts as primary mitigations.

comptable