fill-protocol — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fill-protocol (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Document(template_path), notDocument(): rebuilding loses the header logo, custom margins, footer placeholders and page numbering. Replace cell/paragraph text in place; never a single cell.text = "value" assignment, which erases run-level styles (bold, color, eastAsia font).
pandoc -f doc is notsupported; textutil corrupts table structure (merged cells dropped).
table.cell(2, 1).Templates evolve and coordinate matching breaks silently.
run.font.name, orHangul/Kanji/Hanzi render in fallback fonts.
[MISS] line and every WARN: line([TABLE-MISS], [SECTION-MISS], [RAW-NEWLINE]) before the filled form is submitted.
Python packages docxtpl python-docx pyyaml are always required. LibreOffice is needed only for a legacy .doc template (~700 MB on macOS). The bundled setup.sh detects what is missing:
bash ${CLAUDE_SKILL_DIR}/setup.sh check # report what's installed (read-only)
bash ${CLAUDE_SKILL_DIR}/setup.sh install # install missing pieces (asks before each)When invoking this skill on behalf of a user:
.docx.setup.sh check. If LibreOffice is missing, **ask theuser** before installing, because the cask is ~700 MB.
--yes to setup.sh install unless the user has explicitly authorizedunattended installation in this session, because it installs without prompting.
.doc manually (Word/LibreOffice/Pages → SaveAs → .docx) and re-run with the converted file.
python3 ${CLAUDE_SKILL_DIR}/scripts/doc_to_docx.py path/to/template.doc path/to/template.docxpython3 ${CLAUDE_SKILL_DIR}/scripts/inspect_template.py path/to/template.docxIt lists every table, every cell (coordinates and content preview) and every top-level paragraph. Take the exact labels for the YAML from this output.
Start from ${CLAUDE_SKILL_DIR}/examples/example_irb_template.yaml. Three fill modes; all keys are optional.
protections:
korean_font: "맑은 고딕" # CJK font (set to "Noto Sans CJK KR", "SimSun",
# "MS Mincho", etc. for other locales)
cant_split: true # Apply <w:cantSplit/> to every filled row
# Readability options (defaults shown)
blank_between_paragraphs: true # Enter between \n\n chunks
blank_around_section_header: true # Enter above/below filled sections
blank_around_all_section_headers: false # opt-in; also touches untouched sections
normalize_page_breaks: true # empty page-break paragraphs -> pageBreakBefore
# Mode 1 — table key/value (left-label cell → right value cell)
table_kv:
"Study Title": "Multi-center prospective validation of ..."
"Principal Investigator": "Last, First (Department)"
"연구 목적": "본 연구는 ..."
# Mode 2 — section replacement (find numbered header, replace until next header)
section_replace:
"1. Background":
"Hepatocellular carcinoma is the third leading cause of ..."
"4. 연구 배경 및 이론적 근거":
"..."
# Mode 3 — single paragraph in-place text replacement
paragraph_replace:
"Title:":
"Title: Multi-center prospective validation of ..."Read ${CLAUDE_SKILL_DIR}/references/best_practices.md (Readability knobs) before changing any readability option from its default.
Content rules: put a reference in only with a /search-lit-confirmed DOI or PMID, otherwise mark it [UNVERIFIED - NEEDS MANUAL CHECK]; mark any unconfirmed clinical definition, diagnostic criterion or guideline claim [VERIFY] and ask the user.
python3 ${CLAUDE_SKILL_DIR}/scripts/fill_form.py \
--template path/to/template.docx \
--content content.yaml \
--output path/to/filled.docxThe CLI prints [OK] / [MISS] for every fill operation, a summary, then any WARN: lines. Investigate every [MISS] and WARN: before submitting (Principle 6).
Every value under table_kv, section_replace and paragraph_replace is written exactly as typed (012345, 12:30, 1.10, No stay text). An empty value or a list/mapping value stops the run with exit 2 and names the label; write '' to blank a field on purpose. A section_replace on a header with no later numbered header replaces everything to the end of the document, and its [OK] line says so with the number of paragraphs replaced. If a signature/date block or anything else follows the last section, bound it with section_end (header -> regex matched against the paragraph that starts the kept block):
section_end:
"18. References": "^Investigator signature"soffice --headless --convert-to pdf path/to/filled.docxWithout LibreOffice (a .docx template skips it), export the PDF from Word instead. Open the PDF and confirm: page count is sensible, no table row was split across pages, no font fell back to Times New Roman, all required fields are populated.
Read ${CLAUDE_SKILL_DIR}/references/best_practices.md when a label or section header does not match, the template has no numbered section headers (section_end), a cell needs multi-line content, or cells are merged.
.docx first.merged region's content. Test on a copy first.
content only.
section_end pattern is given; the filler cannot tell the section body from a trailing block.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.