The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/excel_yml_gen.py executes a secondary tool (yml2reg.py) using subprocess.run. This is handled safely by passing arguments as a list (argument vector) rather than a shell string, which effectively mitigates shell injection vulnerabilities.
[SAFE]: Dependency management is standard; the tool requires pandas and openpyxl for Excel data handling. No unauthorized network activity, sensitive data exfiltration, or remote code downloads were detected.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests data from Excel workbooks provided by users and interpolates it into generated YAML and Verilog artifacts. If these outputs are subsequently processed by an AI agent or automated pipeline, the lack of input sanitization could lead to indirect injection.
Ingestion points: scripts/excel_yml_gen.py reads user-controlled data via pandas.read_excel (specifically register names and descriptions).
Boundary markers: Absent. The script concatenates Excel values directly into formatted strings without delimiters or warnings for downstream agents.
Capability inventory: The skill has file system write capabilities (open) and can execute secondary scripts via subprocess.run.
Sanitization: No validation or escaping mechanisms are present to handle potentially malicious content within the Excel cells before it is incorporated into code artifacts.

excel-yml-gen