The Agent Skills Directory

[SAFE]: The skill is primarily instructional, providing detailed markdown documentation to guide an AI agent in explaining Israeli tax laws and preparing drafts of forms. No malicious commands, obfuscated content, or persistence mechanisms were detected.
[NO_CODE]: The skill contains no executable scripts (e.g., .py, .js, .sh) or binaries. It operates by providing context and reference data to the AI agent, minimizing the risk of arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect injection as it is designed to process user-supplied financial and personal data for tax calculations.
Ingestion points: Untrusted data enters the context through user responses to prompts about income, entity type, and family status defined in SKILL.md and SKILL_HE.md.
Boundary markers: The skill employs structured headers and a multi-step workflow (Steps 1-9) to separate calculation phases, although it does not provide explicit data delimiters.
Capability inventory: The skill is configured with Bash(python:*) and WebFetch tools, but lacks any instructions or code to utilize these for unauthorized file access, network exfiltration, or persistence.
Sanitization: No explicit input validation or escaping logic is included in the instructions, with the skill relying on the LLM's interpretation of numerical data.
[EXTERNAL_DOWNLOADS]: The skill references and retrieves configuration data from official Israeli government portals (gov.il, misim.gov.il) and well-known legal information services (kolzchut.org.il, nevo.co.il). These sources are trusted within the context of the skill's primary purpose and do not represent a security risk.

israeli-tax-returns