The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external financial documents (bank statements, invoices, bookkeeper files). This introduces a surface for indirect prompt injection where malicious content inside a document could attempt to manipulate the agent's behavior.
Ingestion points: Document reading occurs in Phase 2 across multiple file types (PDF, CSV, XLSX) from user-specified directories.
Boundary markers: The instructions do not define explicit boundary markers or safety wrappers to isolate untrusted content from the system prompt logic.
Capability inventory: The skill possesses the capability to read local files, write to the filesystem, and execute shell commands.
Sanitization: No sanitization or validation logic is specified for the data extracted from the documents before it is interpolated into the analysis phase or the final report.
[COMMAND_EXECUTION]: The skill workflow concludes by automatically executing the open (macOS) or xdg-open (Linux) command to launch the generated HTML report in the user's default browser.
[EXTERNAL_DOWNLOADS]: The generated HTML report includes a link to Google Fonts. Opening the report results in an external network request to fetch these assets, which is a common but notable external reference for a skill processing sensitive PII.

accounting