The Agent Skills Directory

[SAFE]: The skill operates as an analytical tool for regulatory posture assessment. It strictly adheres to specified 'sensitive-skill-guardrails', including the placement of mandatory disclaimers and the declaration of assumed jurisdictions.
[SAFE]: Data ingestion is limited to organization names, jurisdictions, and internal paths for prior audit outputs or knowledge packs. There are no patterns suggesting unauthorized data exfiltration or access to sensitive local environment variables (e.g., .ssh, .aws).
[SAFE]: The skill utilizes a structured orchestration pattern, delegating specific sub-tasks to identified personas (e.g., ai-architect, general-counsel) through established internal protocols. This ensures that the agent's capabilities are restricted to those defined within the 'Product Org OS' ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an inherent attack surface by processing external data sources such as organizational documentation and outputs from other skills.
Ingestion points: Inputs from --prior PATH, technical documentation, and the /ai-control-audit skill output.
Boundary markers: Includes a comprehensive four-sided boundary statement and a 'Cannot Assess Without' section to limit reliance on the agent's output.
Capability inventory: The skill produces a markdown report but does not have capabilities for arbitrary command execution or network operations outside of standard tool calls.
Sanitization: The methodology requires manual review by licensed counsel and a named human tiebreaker for high-stakes audits, mitigating the risk of automated obedience to embedded instructions.

ai-regulatory-audit