The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary instructions (SKILL.md) suggest that the user install the uv package manager via a piped shell script (curl -LsSf https://astral.sh/uv/install.sh | sh) if it is not already present. While this is the official installation method for this well-known and widely used technology tool from Astral, it represents a remote code execution pattern.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: The skill ingests Culture Index PDF profiles via scripts/extract_pdf.py, as well as raw interview transcripts via workflows/predict-from-interview.md.
Boundary markers: The workflows do not specify explicit delimiters or 'ignore' instructions for the data being interpolated into the agent's context during transcript analysis.
Capability inventory: The skill is allowed to use Bash, Read, Grep, Glob, and Write tools, enabling it to read sensitive files or write arbitrary report content based on the input data.
Sanitization: The extract_pdf.py script utilizes OpenCV for visual extraction of data points from charts, which provides a layer of physical sanitization for PDF inputs. However, interview transcripts are processed as raw text without sanitization.
[DYNAMIC_EXECUTION]: The skill executes a local Python script (scripts/extract_pdf.py) using the uv runner to perform data extraction. The script utilizes standard libraries such as numpy and opencv-python-headless, and interacts with system binaries like tesseract and poppler through FFI wrappers.
[EXTERNAL_DOWNLOADS]: The skill defines and manages external Python dependencies (e.g., opencv-python-headless, numpy, pdf2image, pytesseract) using PEP 723 script metadata and a uv.lock file to ensure integrity. These packages are fetched from standard public registries (PyPI).

interpreting-culture-index