The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python-based calculator script (scripts/crypto-gains-calculator.py) to process transaction data. The execution is performed via standard shell commands (e.g., python scripts/crypto-gains-calculator.py --input transactions.csv --year 2024). The script itself is self-contained, uses only standard Python libraries (argparse, csv, json, sys, collections, dataclasses, datetime), and does not attempt any remote code execution or network operations. The allowed-tools frontmatter correctly limits the scope to necessary Python execution and file reading.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were found. The skill mentions an external MCP server for exchange rates (BOI Exchange Rates), but this is a recommendation for the user/environment rather than a hardcoded requirement in the skill's scripts. The calculator script specifically refuses to perform any external network lookups or currency conversions, requiring the user to provide shekel-denominated values in the input CSV.
[DATA_EXFILTRATION]: No data exfiltration patterns were detected. The skill reads local CSV files for tax processing but does not contain any instructions or code to send this sensitive financial data to external servers.
[PROMPT_INJECTION]: The instructions are strictly informational and focus on regulatory compliance. There are no attempts to override system prompts or bypass safety filters. Phrases like 'IMPORTANT' are used in a benign, instructional context (e.g., regarding total consideration in CSVs).
[OBFUSCATION]: The skill and its associated scripts are written in clear, documented code and natural language (English and Hebrew). There is no use of Base64, zero-width characters, or homoglyphs to hide malicious intent.

israeli-crypto-tax-reporter