The Agent Skills Directory

[SAFE]: The skill serves as a local data transformation tool for hardware engineers. It extracts signal names and frequencies from Excel and CSV files to recommend PLL architectures and generate topology diagrams in Draw.io and Excalidraw formats. Analysis of the source code confirms the use of standard libraries (pandas, openpyxl, xml.etree) for these tasks. No patterns of data exfiltration, hardcoded credentials, or privilege escalation were detected.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection as it ingests untrusted data from external files. 1. Ingestion points: Data enters via scripts/parser.py and scripts/req_parser.py when reading Excel/CSV files. 2. Boundary markers: The skill does not use specific delimiters to separate untrusted data from system instructions, as it primarily performs structural analysis. 3. Capability inventory: The skill is restricted to local file manipulation within designated output directories and does not have network or subprocess execution capabilities. 4. Sanitization: While the skill cleans data for structural consistency, it does not explicitly filter for prompt injection content; however, the lack of dangerous downstream capabilities makes this surface low-risk.

crg-design-gen