The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions are focused entirely on trade compliance domain expertise. No patterns attempting to bypass safety filters, override system instructions, or extract system prompts were detected.
[DATA_EXFILTRATION]: No hardcoded credentials or sensitive file paths were identified. While the skill discusses sensitive topics like API keys and private keys in the context of trade documentation, it does not include logic to access or transmit such secrets. Network-related keywords like curl and wget are used only as examples in documentation templates.
[REMOTE_CODE_EXECUTION]: There are no patterns involving the download or execution of remote scripts. No shell piping (curl | bash) or dynamic code execution patterns are present.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it is designed to analyze external trade data, including Bill of Materials (BOMs), commercial invoices, and supplier questionnaires.
Ingestion points: Data enters the context through analysis tasks described in SKILL.md and references/decision-frameworks.md.
Boundary markers: The skill includes explicit instructions for verification and adjudication of external data (e.g., Screening Hit Assessment protocol).
Capability inventory: The skill lacks any dangerous capabilities such as file-writing, network exfiltration, or subprocess execution, rendering the injection surface non-exploitable.
Sanitization: Instructions emphasize cross-referencing and technical verification of supplier-provided data.
[OBFUSCATION]: No Base64, zero-width characters, homoglyphs, or other obfuscation techniques were found. The text is plain, human-readable markdown across all reference files.
[DYNAMIC_CONTEXT_INJECTION]: The skill does not utilize the !command syntax for shell execution at load time. References to ! in the text are standard markdown bullet points or punctuation.

customs-trade-compliance