The Agent Skills Directory

[SAFE]: The skill is entirely instructional and data-driven, providing a comprehensive framework for open-source licensing strategy. It contains no executable scripts, network operations, or sensitive data access.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from a user's repository (e.g., manifest files like go.mod or package.json). While this creates an ingestion surface for indirect prompt injection, the skill's instructions include strong defensive constraints, such as the mandate to refuse legal advice and the requirement to source every claim from its internal reference files. These constraints effectively mitigate the risk of the agent being diverted from its primary goal.
Ingestion points: Step 1 instructions specify reading repository manifests, lockfiles, and dependency lists.
Boundary markers: The skill explicitly instructs the agent to define boundaries, such as "Refuse legal advice" and "Source every claim, or label it as this skill's own default."
Capability inventory: The skill's primary capability is generating a structured "license decision record" and recommending file additions (e.g., LICENSE, CONTRIBUTING.md). It does not have autonomous write or execute permissions mentioned in the instructions.
Sanitization: The skill relies on a rigid output template and internal reference checks rather than directly interpolating untrusted input into a prompt without context.
[NO_CODE]: The skill consists solely of markdown instructions and YAML metadata, with no accompanying executable code or system commands. All file interactions described are hypothetical actions for the agent to perform within a safe execution environment.

oss-license-strategy