The Agent Skills Directory

[SAFE]: The skill is entirely instructional and provides reference material for compliance auditing. It does not include any executable scripts or tools within its distribution.
[SAFE]: Data processing is limited to mapping user-provided compliance requirements to established regulatory frameworks. There is no evidence of unauthorized file access, network exfiltration, or credential harvesting.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a minimal attack surface for indirect injection because it processes user-provided descriptions of system controls. However, the skill lacks autonomous execution capabilities (relying on delegation to a 'Builder' agent), which significantly mitigates this risk.
Ingestion points: Regulatory requirement descriptions and control implementation details provided by the user (SKILL.md).
Boundary markers: Absent in prompt templates.
Capability inventory: Limited to structured reporting and mapping; no file-writing or command-execution tools are present in the skill instructions.
Sanitization: No explicit sanitization of external text is defined.
[EXTERNAL_DOWNLOADS]: The skill provides examples of CI/CD configurations in its reference files (e.g., policy-as-code.md) that download well-known, legitimate tools like the Open Policy Agent (OPA) 'conftest' utility from GitHub. These are documented for instructional purposes and are not executed by the agent itself.

comply