The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external regulatory data and project-specific documents. * Ingestion points: Project documents accessed via Glob and Read tools, and external regulatory guidance retrieved via WebFetch and WebSearch. * Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided for processed content. * Capability inventory: The skill possesses capabilities for shell command execution (Bash), file writing (Write), and network requests (WebFetch). * Sanitization: No evidence of validation or sanitization of fetched external content is mentioned.
[EXTERNAL_DOWNLOADS]: Fetches external regulatory guidance and data using the WebFetch and WebSearch tools.
[COMMAND_EXECUTION]: Employs the Bash tool to execute analysis tasks and the Write tool to generate remediation documents and backlogs.
[DATA_EXFILTRATION]: A potential exfiltration surface exists because the skill can read project files and also has network access via WebFetch, although no specific malicious exfiltration logic was observed.

bind-gap