The Agent Skills Directory

[SAFE]: The e-checker skill implements local data validation logic for Excel files. The core engine is well-structured and uses a custom expression evaluator that does not rely on dangerous functions like eval() or exec().
[REMOTE_CODE_EXECUTION]: Analysis of the expression engine (expression/evaluator.py) and the pipeline operator system (operators/base.py) confirms that execution is restricted to a set of predefined mathematical and string manipulation functions. No mechanisms for arbitrary command execution or system call spawning were identified.
[DATA_EXFILTRATION]: The tool performs file read operations using openpyxl and pandas as specified by user-defined rules. There are no network-capable components or functions detected that would allow for the transmission of this data to external servers.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from Excel spreadsheets. This creates a surface for indirect prompt injection if malicious instructions are embedded in cell contents. However, the skill treats this data as values to be validated against patterns, and any anomalies are reported as validation errors. The risk is mitigated by the use of a custom restricted DSL for processing.
Ingestion points: scripts/src/echecker/excel/provider.py and scripts/src/echecker/excel/external_data.py (via pandas).
Boundary markers: Absent in the ConsoleReporter output.
Capability inventory: The skill can read file contents and generate reports for the agent.
Sanitization: No specific prompt injection filtering is applied to the values before they are printed to the console as validation errors.

e-checker