The Agent Skills Directory

[SAFE]: The skill serves as a technical reference and documentation suite for security professionals. All executable scripts, including risk_calculator.py and vuln_prioritizer.py in the scripts/ directory, perform local calculations based on structured data and do not exhibit malicious patterns such as data exfiltration, obfuscation, or unauthorized command execution.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection through the processing of external CSV files in the provided Python scripts.
Ingestion points: CSV files are read via csv.DictReader in the load_risks_from_csv and load_vulnerabilities_from_csv functions within the scripts/ directory.
Boundary markers: Not present in the scripts, which assume the input CSV matches the expected schema.
Capability inventory: The scripts are restricted to standard output (console) and file writing for report generation. No network operations, dynamic code execution, or subprocess spawning are present in the actual skill scripts.
Sanitization: Input data is sanitized through explicit type casting to float and int for numerical fields, which provides a layer of validation against non-numeric injection payloads.

security-compliance