The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the analysis of local project files (source code, tests, and evidence artifacts) to generate compliance scores. This ingestion of untrusted local data creates an attack surface where instructions hidden within comments, metadata, or test names could potentially influence the agent's behavior or its final readiness verdict.\n
Ingestion points: Files located in tests/, src/, and evidence/ directories are searched using grep and find.\n
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the content being processed.\n
Capability inventory: The skill uses local shell commands for discovery and produces compliance matrices based on the found content.\n
Sanitization: No explicit sanitization or validation of the content discovered in the local files is performed by the skill.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to discover evidence of compliance controls within the local file system.\n
Evidence: grep -rE "(test_gdpr|test_ccpa|test_soc2|test_hipaa|test_pci)" tests/\n
Evidence: find evidence/ -name "*.json" -o -name "*.py" -newer evidence/.last-collected\n- [EXTERNAL_DOWNLOADS]: The skill provides references to official regulatory and standards organization websites, such as those for the AICPA, ISO, and the EU. These are trusted and well-known sources used for informational purposes.\n- [DYNAMIC_EXECUTION]: The skill includes Python test templates for the user to adapt. These templates demonstrate how to verify controls like MFA and encryption but do not involve the skill executing dynamically generated code from untrusted sources.

compliance-coverage-scoring