The Agent Skills Directory

[SAFE]: The skill operates entirely in the local environment and explicitly states it uses the Python standard library only, requiring no network access.
[SAFE]: All external URLs provided in the question assets (assets/questions/) point to established, high-reputation design resources, accessibility standards (W3C, GOV.UK), and official documentation from major vendors like Apple, Adobe, and Microsoft.
[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to process untrusted user requests and artifact descriptions, then pass them as arguments to local Python scripts. This creates a potential surface for indirect injection if the scripts do not adequately sanitize inputs.
Ingestion points: Steps 0, 1, 3, 4, 6, 7, 8, and 10 in SKILL.md ingest user-provided text, artifact data, and slugs which are then interpolated into shell commands.
Boundary markers: The instructions consistently use double quotes (e.g., --text "<the request>") to encapsulate variable data in the command templates, which helps mitigate shell injection but does not prevent logic-based injection within the scripts themselves.
Capability inventory: The skill performs file system operations (initialization, reading, and appending to markdown files via scripts/ledger.py) and executes multiple internal analysis scripts (scripts/gate.py, scripts/locate.py, etc.).
Sanitization: The markdown instructions do not specify sanitization steps; security depends on the argument handling logic implemented within the local Python scripts provided in the skill folder.

by-design