The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script template that utilizes subprocess.run to execute standard security auditing tools, specifically npm audit and pip-audit. These operations are consistent with the skill's primary purpose of application security scanning.
[PROMPT_INJECTION]: The instructions provide a framework for security analysis and do not contain attempts to override safety filters or bypass system constraints.
[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface for indirect prompt injection as it is designed to process untrusted code and manifest files. 1. Ingestion points: Processes package.json, requirements.txt, and pyproject.toml. 2. Boundary markers: The provided script does not implement specific delimiters for the ingested file content. 3. Capability inventory: Includes filesystem access and shell command execution via subprocess.run. 4. Sanitization: Relies on standard JSON parsing of tool outputs and does not implement additional filtering for manifest content.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill correctly demonstrates best practices for sensitive data management in its code examples, advocating for the use of environment variables and secrets managers rather than hardcoding credentials.

Application Security Engineer