The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external financial data, such as Fichier des Ecritures Comptables (FEC) and company profiles. This creates a surface for indirect prompt injection if an attacker were to place malicious instructions within accounting labels or company descriptions. However, given that the primary purpose of the skill is the auditing of such data and it lacks high-risk capabilities like network exfiltration or automated file modification, the risk is minimal and inherent to the tool's intended use.
Ingestion points: SKILL.md (processing of FEC files and company.json).
Boundary markers: The instructions direct the agent to specifically look for accounting anomalies and conform to tax rules, providing a strong task-oriented context.
Capability inventory: Local script execution for data analysis; no network access.
Sanitization: The provided Node.js script performs structured parsing of the input files.
[COMMAND_EXECUTION]: The skill uses a local script scripts/analyse-fec.js to perform deterministic accounting checks (balancing, numbering, and PCG mapping). The script was analyzed and found to be safe, containing only logical and mathematical operations on the provided data without any external dependencies or dangerous system calls.

controleur-fiscal