The Agent Skills Directory

[SAFE] (SAFE): The scripts description_generator.py and verify.py perform legitimate text templating and local file validation. No evidence of credential theft, remote code execution, or persistence was found.\n- [Indirect Prompt Injection] (LOW): The script description_generator.py creates a theoretical surface for indirect prompt injection by templating external tool data into Markdown descriptions. However, this is the primary intended function of the script.\n
Ingestion points: properties of the tool_spec object in generate_tool_description.\n
Boundary markers: Uses Markdown headers (e.g., ##, ###) to structure tool definitions.\n
Capability inventory: No dangerous operations (subprocess calls, network requests, or file-write) are present in the scripts.\n
Sanitization: None; the script performs direct string interpolation without escaping or filtering.

tool-design