The Agent Skills Directory

[SAFE]: The skill consists exclusively of Markdown documentation providing templates and best practices for bug bounty reporting (HackerOne, Bugcrowd, etc.). It does not include any functional code or configuration files that execute logic.
[NO_CODE]: No scripts, binaries, or shell commands are present. Code blocks found within the Markdown files (such as Python, Solidity, and HTTP snippets) are illustrative examples meant for report inclusion, not for execution by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data (security engagement notes) into a structured report format, which constitutes a potential injection surface.
Ingestion points: The skill instructions specify applying the templates to 'current engagement notes' provided in the agent context.
Boundary markers: The skill relies on standard Markdown structure to separate sections but does not implement programmatic boundary markers or 'ignore' instructions.
Capability inventory: None. The skill files contain no tools, scripts, or permissions to perform file-system writes, network operations, or subprocess execution.
Sanitization: The instructions explicitly mandate the sanitization of secrets and PII (Personally Identifiable Information) before any report is finalized or submitted.

report-writing