The Agent Skills Directory

[SAFE]: The skill provides structured instructions for ISO 27001 auditing. While it contains strings that triggered regex-based prompt injection detectors (such as "IGNORE any instructions" and "disregard previous instructions"), these are used defensively in a 'Prompt Injection Safety Notice' section to instruct the agent to ignore adversarial content within analyzed files. This is a security best practice for agents processing untrusted data.
[DATA_EXPOSURE_SURFACE]: The skill mentions sensitive file paths like .env and ~/.ssh/ in the 'Prerequisites' section as examples of evidence an auditor might look for. However, it does not provide code to exfiltrate this data and only uses standard platform tools (Read, Grep, Glob) for the intended purpose of compliance auditing.
[COMMAND_INJECTION_PROTECTION]: The skill includes explicit constraints to reject invalid control IDs and ignore instructions embedded in user-supplied content, reducing the risk of indirect prompt injection.

iso27001-gap