The Agent Skills Directory

[SAFE]: The skill performs legitimate automation of employment contract generation. It relies on a local Python script to calculate benefit rates and format templates based on user inputs.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it interpolates user-supplied data into the generated contract output.
- Ingestion points: User-provided strings for employee names, job positions, and start dates are passed as arguments to scripts/generate_contract.py via the agent.
- Boundary markers: The skill does not currently use explicit boundary markers or delimiters around user-interpolated content in the Markdown output.
- Capability inventory: The skill uses the Bash tool to execute scripts/generate_contract.py, which has the capability to write the generated contract to the local filesystem if the --output flag is used.
- Sanitization: There is no evidence of string sanitization or input validation performed by the generation script before interpolation.
[SAFE]: All external URLs referenced in the skill point to trusted and well-known Israeli legal and government resources, including Kol Zchut (kolzchut.org.il), Bituach Leumi (btl.gov.il), and Nevo (nevo.co.il). The use of percent-encoding for Hebrew characters in these URLs is a standard protocol requirement and does not constitute malicious obfuscation.
[SAFE]: The Python script scripts/generate_contract.py only utilizes standard library modules (argparse, sys, datetime, typing) and does not perform any network operations, dynamic code execution (eval/exec), or unauthorized file access.

israeli-employment-contracts